# CVE-2026-44541: Ethyca Fides DOM-based XSS in fides.js via description override

Source: https://junglewise.ai/threats/cve-2026-44541-ethyca-fides-dom-based-xss-in-fides-js-via-description-override  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44541 · Severity: high · CVSS 4 · Published 2026-06-08

Ethyca Fides is a privacy platform used to manage user consent banners on websites. A security flaw allows attackers to inject malicious code into these banners through specially crafted links or cookies. If exploited, an attacker could execute unauthorized scripts in a visitor's browser, potentially leading to data theft or unauthorized actions on the website.

Technologies: [Ethyca Fides](https://junglewise.ai/threats/technologies/fides), [ethyca-fides (PyPI)](https://junglewise.ai/threats/technologies/ethyca-fides). Vendors: [Ethyca](https://junglewise.ai/threats/vendors/ethyca), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44541 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44541 being exploited in the wild.

**How severe is CVE-2026-44541?** High severity, with a CVSS score of 4, published 8 June 2026.

**Which products and versions are affected?** Ethyca Fides >= 2.33.0, < 2.84.5; Ethyca Fides Enterprise < 2.84.6; ethyca-fides (PyPI) >= 2.33.0, < 2.84.5, ECOSYSTEM:introduced=2.33.0,fixed=2.84.5.

**Is there a fix for CVE-2026-44541?** Yes. ethyca-fides (PyPI): upgrade to 2.84.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44541 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44541?** Check whether you run Ethyca Fides, Ethyca Fides Enterprise or ethyca-fides (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ethyca-fides (PyPI): upgrade to 2.84.5 or later

  ```sh
  pip install "ethyca-fides>=2.84.5"
  ```


## Technical details

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in fides.js due to a trust gap between the runtime override mechanism and HTML-formatted descriptions. When the FIDES_PRIVACY_CENTER__ALLOW_HTML_DESCRIPTION environment variable is enabled, the application renders the banner description as live HTML. The fides.js script allows the description to be overridden via URL query parameters, JavaScript globals, or cookies without passing through server-side sanitization (nh3). An attacker can provide a malicious payload via the fides_description parameter, which is then executed in the context of the victim's browser. This is particularly impactful when delivered via cookies, as the payload can persist across subdomains and subsequent sessions.

## Affected products

- Ethyca ethyca-fides >= 2.33.0, < 2.84.5
- Ethyca Fides Enterprise < 2.84.6

## Identifiers

- CVE-2026-44541
- GHSA-5qrq-9645-g5g2
- PYSEC-2026-2470

## Timeline

- 2026-05-14: disclosed
- 2026-05-14: advisory
- 2026-05-14: patched: Patched in Fides OSS 2.84.5 and Fides Enterprise 2.84.6

## References

- [https://api.github.com/users/daveqnet](https://api.github.com/users/daveqnet)
- [https://github.com/daveqnet](https://github.com/daveqnet)
- [https://api.github.com/users/daveqnet/gists%7B/gist_id%7D](https://api.github.com/users/daveqnet/gists%7B/gist_id%7D)
- [https://api.github.com/users/daveqnet/repos](https://api.github.com/users/daveqnet/repos)
- [https://avatars.githubusercontent.com/u/83430497?v=4](https://avatars.githubusercontent.com/u/83430497?v=4)
- [https://api.github.com/users/daveqnet/events%7B/privacy%7D](https://api.github.com/users/daveqnet/events%7B/privacy%7D)

## Related threats

- [PYSEC-2026-1343 - Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation](https://junglewise.ai/threats/cve-2025-57817-fides-webserver-api-is-vulnerable-to-oauth-client-privilege)
- [PYSEC-2026-1341 - Fides Webserver API Rate Limiting Vulnerability in Proxied Environments](https://junglewise.ai/threats/cve-2025-57816-fides-webserver-api-rate-limiting-vulnerability-in-proxied)
- [PYSEC-2026-1335 - Fides has a Lack of Brute-Force Protections on Authentication Endpoints](https://junglewise.ai/threats/cve-2025-57815-fides-has-a-lack-of-brute-force-protections-on-authentication)
- [PYSEC-2026-1348 - Fides' Admin UI User Password Change Does Not Invalidate Current Session](https://junglewise.ai/threats/cve-2025-57766-fides-admin-ui-user-password-change-does-not-invalidate-current)
- [PYSEC-2026-1349 - Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API](https://junglewise.ai/threats/cve-2024-52008-password-policy-bypass-vulnerability-in-fides-webserver-user)