CVE-2026-44541

HighCVSS 7.0

Published: 08/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

Fides is an open-source privacy engineering platform. From version 2.33.0 to before 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This has been patched in version 2.84.5.

Risk Assessment

An attacker can inject malicious JavaScript that executes in the victim's browser, leading to session theft, redirects, or data theft.

Recommendation

Upgrade Fides to version 2.84.5 or later and review any custom fides_description overrides.

Other vulnerabilities in Fides

CVE-2026-42303Medium
In Fides from 2.75.0 to before 2.83.2, deployments enabling both subject identity verification and duplicate privacy request detection allow an administrator to approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across all integrations.

Original NVD description (English source)

Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS