What’s Vulnerable › Vulnerabilities

CVE-2026-44541: Fides: DOM-based XSS vulnerability in fides.js via fides_description override

• Severity: high (CVSS 7.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-08 · updated 2026-07-23
• Weakness: CWE-79

Description

Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.

Affected products

• ethyca fides: from 2.33.0, < 2.84.5

References

• https://github.com/ethyca/fides/commit/67e43b10b1096c7f84d5c0eeba08ee3b7846b7cd
• https://github.com/ethyca/fides/releases/tag/2.84.5
• https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2
• https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2

Get alerted when CVE-2026-44541 or the next vulnerability affects your stack