Is CVE-2026-44541 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44541 being exploited in the wild.

How severe is CVE-2026-44541?

High severity, with a CVSS score of 4, published 8 June 2026.

Which products and versions are affected?

Ethyca Fides >= 2.33.0, = 2.33.0, < 2.84.5, ECOSYSTEM:introduced=2.33.0,fixed=2.84.5.

Is there a fix for CVE-2026-44541?

Yes. ethyca-fides (PyPI): upgrade to 2.84.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44541 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44541?

Check whether you run Ethyca Fides, Ethyca Fides Enterprise or ethyca-fides (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44541: Ethyca Fides DOM-based XSS in fides.js via description override

Q: Is there a fix for CVE-2026-44541?

Yes. ethyca-fides (PyPI): upgrade to 2.84.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44541 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44541?

Check whether you run Ethyca Fides, Ethyca Fides Enterprise or ethyca-fides (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44541 · Severity: high · CVSS 4 · Published 2026-06-08

Ethyca Fides is a privacy platform used to manage user consent banners on websites. A security flaw allows attackers to inject malicious code into these banners through specially crafted links or cookies. If exploited, an attacker could execute unauthorized scripts in a visitor's browser, potentially leading to data theft or unauthorized actions on the website.

Technologies: Ethyca Fides, ethyca-fides (PyPI). Vendors: Ethyca, PyPI.

Quick answers

Is CVE-2026-44541 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44541 being exploited in the wild.
How severe is CVE-2026-44541?: High severity, with a CVSS score of 4, published 8 June 2026.
Which products and versions are affected?: Ethyca Fides >= 2.33.0, < 2.84.5; Ethyca Fides Enterprise < 2.84.6; ethyca-fides (PyPI) >= 2.33.0, < 2.84.5, ECOSYSTEM:introduced=2.33.0,fixed=2.84.5.
Is there a fix for CVE-2026-44541?: Yes. ethyca-fides (PyPI): upgrade to 2.84.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44541 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44541?: Check whether you run Ethyca Fides, Ethyca Fides Enterprise or ethyca-fides (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ethyca-fides (PyPI): upgrade to 2.84.5 or later
```
pip install "ethyca-fides>=2.84.5"
```

Technical details

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in fides.js due to a trust gap between the runtime override mechanism and HTML-formatted descriptions. When the FIDES_PRIVACY_CENTER__ALLOW_HTML_DESCRIPTION environment variable is enabled, the application renders the banner description as live HTML. The fides.js script allows the description to be overridden via URL query parameters, JavaScript globals, or cookies without passing through server-side sanitization (nh3). An attacker can provide a malicious payload via the fides_description parameter, which is then executed in the context of the victim's browser. This is particularly impactful when delivered via cookies, as the payload can persist across subdomains and subsequent sessions.

Affected products

Ethyca ethyca-fides >= 2.33.0, < 2.84.5
Ethyca Fides Enterprise < 2.84.6

Identifiers

CVE-2026-44541
GHSA-5qrq-9645-g5g2
PYSEC-2026-2470

Timeline

2026-05-14: disclosed
2026-05-14: advisory
2026-05-14: patched: Patched in Fides OSS 2.84.5 and Fides Enterprise 2.84.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.