CVE-2026-44541— Fides: DOM-based XSS vulnerability in fides.js via fides_description override
Possible ATT&CK Techniques 3AI
T1059.007 · JavaScript T1505.003 · Web Shell T1189 · Drive-by CompromiseGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44541
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fides: DOM-based XSS vulnerability in fides.js via fides_description override
Source: NVD (National Vulnerability Database)
Vulnerability Description
Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Fides 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Fides是Ethyca开源的一个开源隐私工程平台，用于管理运行时环境中数据隐私请求的实现以及代码中隐私法规的执行。 Fides 2.33.0版本至2.84.5之前版本存在跨站脚本漏洞，该漏洞源于fides.js中的fides_description覆盖存在基于DOM的跨站脚本漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44541
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44541
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44541 (1)
Vendor Pages for CVE-2026-44541 (1)
- 🔗 Release v2.84.5 · ethyca/fides · GitHubx_refsource_MISC
IV. Related Vulnerabilities
Same product: fides
- CVE-2026-42303
Fides: Privacy Request Identity Verification Bypass Vulnerab - CVE-2025-57817
Fides Webserver API is Vulnerable to OAuth Client Privilege - CVE-2025-57816
Fides Webserver API Rate Limiting Vulnerability in Proxied E - CVE-2025-57766
Fides's Admin UI User Password Change Does Not Invalidate Cu - CVE-2025-57815
Fides Lacks Brute-Force Protections on Authentication Endpoi
Same vendor: ethyca
- CVE-2026-42303
Fides: Privacy Request Identity Verification Bypass Vulnerab - CVE-2025-57817
Fides Webserver API is Vulnerable to OAuth Client Privilege - CVE-2025-57816
Fides Webserver API Rate Limiting Vulnerability in Proxied E - CVE-2025-57766
Fides's Admin UI User Password Change Does Not Invalidate Cu - CVE-2025-57815
Fides Lacks Brute-Force Protections on Authentication Endpoi
Same weakness: CWE-79
- CVE-2023-37508
HCL DevOps Plan is susceptible to a Cross-Site Scripting (XS - CVE-2026-15156
Essential Addons for Elementor <= 6.6.11 - Authenticated (Co - CVE-2026-12900
Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contrib - CVE-2026-44230
RT: Reflected Cross-Site Scripting in search results chart - CVE-2026-44229
RT: Cross-Site Scripting via inline-served uploaded content
V. Comments for CVE-2026-44541
No comments yet