7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44541

CVE-2026-44541: Fides: DOM-based XSS vulnerability in fides.js via fides_description override

Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44541

CVE-2026-44541:

7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ethyca-fides	pip	>= 2.33.0, < 2.84.5	2.84.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a DOM-based Cross-Site Scripting (XSS) in fides.js. It occurs when the fides_description override is used on a site that allows HTML in the banner description. The root cause is that client-side overrides for the banner description were not sanitized before being rendered. An attacker could craft a URL with a malicious fides_description parameter, and when a user clicks it, the malicious script would execute in the context of the user's browser on that domain.

The patch addresses this by completely removing the feature for client-side overrides of experience translations like title and description.

The analysis of the patch commit 67e43b10b1096c7f84d5c0eeba08ee3b7846b7cd reveals the vulnerable code path. The init function in fides.ts (and its variants) would call getOverridesByType to fetch overrides from URL parameters, cookies, or global variables. This included the fides_description parameter. These overrides were then passed down through a chain of functions: initialize -> initializeI18n -> loadMessagesFromExperience -> extractMessagesFromExperienceConfig.

The function extractMessagesFromExperienceConfig is the core of the vulnerability. It contained logic to substitute the server-provided description with the user-provided override. This override was then used to render the banner, and if the allowHTMLDescription flag was set, it was rendered as raw HTML, leading to XSS.

The patch removes this entire override mechanism for experience translations, effectively cutting off the supply of untrusted data. The key vulnerable functions identified are init, which starts the process, and extractMessagesFromExperienceConfig, which applies the malicious data. The TcfOverlay component is also identified as it was another entry point for fetching these overrides. Any of these functions could appear in a profiler stack trace during exploitation.

Vulnerable functions

extractMessagesFromExperienceConfig

clients/fides-js/src/lib/i18n/i18n-utils.ts

This function is responsible for processing and applying translations for the consent experience. The vulnerability lies in the fact that it previously prioritized client-side overrides (like 'fides_description' from a URL) over the server-provided text. The 'overrideValue' was not sanitized, and if it contained HTML/JavaScript and the 'allowHTMLDescription' option was enabled, it would be rendered directly into the DOM, causing a cross-site scripting (XSS) vulnerability. The patch removes the logic that applies these overrides.

init

clients/fides-js/src/fides.ts

This is the main initialization function for fides.js. It was the entry point for the vulnerability, as it was responsible for triggering the retrieval of runtime overrides from URL parameters, cookies, or global variables. The patch removed the call to 'getOverridesByType' for experience translations, which was the function that read the malicious 'fides_description' parameter.

TcfOverlay

clients/fides-js/src/components/tcf/TcfOverlay.tsx

This React component, which renders the consent overlay, also contained logic to fetch and apply the vulnerable translation overrides. It independently called 'getOverridesByType' and passed the untrusted data to 'loadMessagesFromExperience', making it part of the vulnerable data flow. This function would appear in a runtime profile during the rendering of the vulnerable banner.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.