XSS in Ethyca Fides
CVE-2026-44541
Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (21.9th percentile) — read the EPSS interpretation.
Affected products
- Ethyca Fides — versions >= 2.33.0, < 2.84.5
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)