CVE-2026-44541: Fides Privacy Platform XSS Vulnerability

CVE-2026-44541 Overview

CVE-2026-44541 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Fides, an open-source privacy engineering platform maintained by Ethyca. The flaw resides in fides.js and is triggered through the fides_description override. Versions from 2.33.0 up to (but not including) 2.84.5 are affected. The issue is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Fides version 2.84.5 contains the official patch.

Critical Impact
Attackers can inject arbitrary JavaScript into the consent overlay rendered by fides.js, executing code in the context of any site embedding the affected library.

Affected Products

Ethyca Fides versions 2.33.0 through 2.84.4
The fides-js client library (clients/fides-js)
Sites embedding the Fides consent overlay (including the TCF overlay component)

Discovery Timeline

2026-06-08 - CVE-2026-44541 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-44541

Vulnerability Analysis

Fides is a privacy engineering platform that renders consent banners and overlays through its JavaScript client, fides.js. The library supports runtime experience translation overrides, allowing site operators to customize text such as descriptions and notices. The vulnerability stems from the fides_description override path, where attacker-controllable content is interpolated into the DOM without sufficient sanitization.

Because the override is processed client-side, an attacker who can influence the override value (through query parameters, cookies, or other client-side inputs consumed by the override mechanism) can inject HTML and JavaScript. The injected payload runs within the embedding site's origin, giving the attacker access to session cookies, local storage, and authenticated browser context.

Root Cause

The root cause is unsafe handling of translation override values inside the Fides experience initialization flow. The pre-patch code path accepted FidesExperienceTranslationOverrides content and rendered it through DOM sinks without proper encoding. The upstream fix removes reliance on the unsafe FidesExperienceTranslationOverrides import and OverrideType consumption in the TCF overlay and headless entry points.

Attack Vector

Exploitation requires no authentication or user interaction beyond loading a page that initializes fides.js with an attacker-influenced fides_description override. The attack vector is network-based, with the injected script executing in the victim's browser. Successful exploitation impacts the confidentiality and integrity of the subsequent system (the embedding web application) rather than Fides itself.

typescript

// Patch excerpt: clients/fides-js/src/components/tcf/TcfOverlay.tsx
   ConsentMechanism,
   ConsentMethod,
   EmptyExperience,
-  FidesExperienceTranslationOverrides,
   FidesModalDefaultView,
   NoticeConsent,
-  OverrideType,
   PrivacyExperience,
   PrivacyExperienceMinimal,
   PrivacyNoticeWithPreference,

Source: GitHub commit 67e43b1

typescript

// Patch excerpt: clients/fides-js/src/fides-headless.ts
 import {
   FidesConfig,
   FidesCookie,
-  FidesExperienceTranslationOverrides,
   FidesGlobal,
   FidesInitOptionsOverrides,
   FidesOverrides,

Source: GitHub commit 67e43b1. The patch removes the unsafe translation override imports from both the TCF overlay and the headless client, eliminating the sink that processed fides_description.

Detection Methods for CVE-2026-44541

Indicators of Compromise

Unexpected <script> tags or inline event handlers rendered inside Fides consent overlay DOM nodes
Outbound browser requests to attacker-controlled domains originating from pages embedding fides.js
URLs, cookies, or referrers containing fides_description parameters with HTML or JavaScript payloads
Console errors related to Content Security Policy violations on pages loading the Fides overlay

Detection Strategies

Inventory all deployed versions of fides.js and flag any release between 2.33.0 and 2.84.4
Inspect application logs and Web Application Firewall (WAF) telemetry for requests containing fides_description with HTML tags or JavaScript URI schemes
Run DOM XSS scanners against pages that embed the Fides consent banner, focusing on translation override parameters
Review browser CSP report endpoints for violations sourced from the Fides overlay

Monitoring Recommendations

Forward browser CSP violation reports to a centralized logging pipeline and alert on script-src violations on pages using fides.js
Monitor edge and CDN logs for query strings, cookies, or fragments containing fides_description= followed by encoded HTML
Track changes to the deployed fides.js package version through software composition analysis (SCA) tooling

How to Mitigate CVE-2026-44541

Immediate Actions Required

Upgrade Fides to version 2.84.5 or later across all environments embedding fides.js
Audit any custom integrations that pass values into the fides_description override and validate that they originate from trusted server-side configuration
Enforce a strict Content Security Policy that disallows inline scripts on pages serving the Fides overlay
Rotate session tokens for users who may have visited affected pages with untrusted override input

Patch Information

Ethyca published the fix in Fides 2.84.5. The relevant code changes are in commit 67e43b1 and are tracked under GHSA-5qrq-9645-g5g2. Release notes are available at the Fides 2.84.5 release page.

Workarounds

If upgrading is not immediately possible, disable use of the fides_description override and remove any code paths that populate FidesExperienceTranslationOverrides from client-controllable input
Apply a Content Security Policy with script-src 'self' and no unsafe-inline directive on pages embedding the consent overlay
Strip or reject inbound requests carrying fides_description parameters at the WAF or reverse proxy layer until the patch is deployed

bash

# Example: pin Fides to the patched release
npm install fides-js@2.84.5

# Example: WAF rule to drop requests containing inline scripts in the override
# (pseudo-rule, adapt to your WAF syntax)
SecRule ARGS:fides_description "@rx (?i)(<script|javascript:|on\w+=)" \
    "id:1004541,phase:2,deny,status:403,msg:'CVE-2026-44541 Fides XSS attempt'"