{"items":[{"id":"NVI-00018480","kind":"vulnerability","title":"ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5qrq-9645-g5g2","CVE-2026-44541"],"plain_summary":"GitHub lists this reviewed advisory for ethyca-fides. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2ca1dc671fc5848b17e5995b092e2096"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2ca1dc671fc5848b17e5995b092e2096","url":"https://github.com/advisories/GHSA-5qrq-9645-g5g2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-5qrq-9645-g5g2","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T15:13:31.161Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2ca1dc671fc5848b17e5995b092e2096"],"technology":"ethyca-fides","known_exclusions":[],"conditions_summary":"### Summary\n\n`fides.js` is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the overridden value is rendered as live HTML without passing through the server-side sanitiser the rendering path was designed to trust.\n\nThe result is a DOM-based XSS that any visitor can trigger with a crafted link, no authentication required. The cookie source lets the payload persist, so a single click can plant a payload that fires on every subsequent banner render across all subdomains until cookies are cleared.\n\n### Am I affected?\n\nThis vulnerability affects Fides Enterprise deployments that use `fides.js` for consent management, a.k.a. \"Janus\", and have HTML-formatted banner descriptions enabled (the `FIDES_PRIVACY_CENTER__ALLOW_HTML_DESCRIPTION` Privacy Center container env var set to `true` ). Deployments that do not load `fides.js`, or that leave HTML descriptions off (the default), are not affected. The vulnerable code lives in the open-source `ethyca-fides` PyPI package, which is ","public_affected_ranges":[">= 2.33.0, < 2.84.5"]}],"null_published_at":"2026-11-07T07:07:39.840Z","source_updated_at":"2026-06-09T13:12:20.000Z","source_disclosed_at":"2026-05-14T19:04:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T15:13:31.161Z"}],"next_cursor":null,"snapshot_revision":"42594"}