ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override
Date: 2026-05
Affected: pip/ethyca-fides
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-44541
CWE: CWE-79

### Summary `fides.js` is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the overridden value is rendered as live HTML without passing through the server-side sanitiser the rendering path was designed to trust. The result is a DOM-based XSS that any visitor can trigger with a crafted link, no authentication required. The cookie source lets the payload persist, so a single click can plant a payload that fires on every subsequent banner render across all subdomains until cookies are cleared. ### Am I affected? This vulnerability affects Fides Enterprise deployments that use `fides.js` for consent management, a.k.a. "Janus", and have HTML-formatted banner descriptions enabled (the `FIDES_PRIVACY_CENTER__ALLOW_HTML_DESCRIPTION` Privacy Center container env var set to `true` ). Deployments that do not load `fides.js`, or that leave HTML descriptions off (the default), are not affected. The vulnerable code lives in the open-source `ethyca-fides` PyPI package, which is why this is published as a GHSA and CVE against Fides OSS, but only Fides Enterprise consent management platform deployments exercise the affected path. To self-test, visit any page where your site loads the consent banner, replacing `<your-site>`: ``` https://<your-site>/?fides_override_language=


Mitigations:

Architectural layers (MAESTRO):