Executive brief
Ethyca Fides is a privacy platform used to manage user consent banners on websites. A security flaw allows attackers to inject malicious code into these banners through specially crafted links or cookies. If exploited, an attacker could execute unauthorized scripts in a visitor's browser, potentially leading to data theft or unauthorized actions on the website.
Technical details
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in fides.js due to a trust gap between the runtime override mechanism and HTML-formatted descriptions. When the FIDES_PRIVACY_CENTER__ALLOW_HTML_DESCRIPTION environment variable is enabled, the application renders the banner description as live HTML. The fides.js script allows the description to be overridden via URL query parameters, JavaScript globals, or cookies without passing through server-side sanitization (nh3). An attacker can provide a malicious payload via the fides_description parameter, which is then executed in the context of the victim's browser. This is particularly impactful when delivered via cookies, as the payload can persist across subdomains and subsequent sessions.
Affected products
- Ethyca ethyca-fides >= 2.33.0, < 2.84.5
- Ethyca Fides Enterprise < 2.84.6
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory
- 2026-05-14: patched: Patched in Fides OSS 2.84.5 and Fides Enterprise 2.84.6