CVE-2026-44541: Fides: DOM-based XSS vulnerability in fides.js via fides_description override

Synopsis

DOM-based cross-site scripting (XSS) is present in the Fides open-source privacy engineering platform, specifically in the fides.js library via the fides_description override, affecting versions 2.33.0 through 2.84.5. The vulnerability is reachable over the network with no authentication required, though successful exploitation depends on a specific precondition being met in the target environment. A successful attack grants the attacker high integrity and confidentiality impact on the system scope, enabling script injection that can modify page content and exfiltrate data from affected browser sessions. HarborGuard tracks this advisory and will make a patched-image rebuild available for environments running an affected version as soon as version 2.84.5 is confirmed in upstream package feeds.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable fides.js code is served over the network, so an attacker must be able to reach the affected web endpoint to deliver the malicious fides_description payload.

• AuthenticationNot required

  No account or credentials are needed; the fides_description override can be supplied by an unauthenticated party.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed to trigger the DOM-based XSS once the payload is in place.

• Attack complexityDetail

  While the basic exploit requires no complex conditions, the AT:P token indicates a specific precondition in the deployment environment must be present for the attack to succeed, making exploitation opportunistic rather than universally reliable.

Blast Radius

• An attacker can inject arbitrary JavaScript into pages rendered by fides.js, rewriting visible page content seen by users interacting with the privacy consent UI.
• Injected scripts can read and exfiltrate session tokens, cookies, or form input captured in the browser context of the affected page.
• Because the integrity impact is scoped to the system (SC:H, SI:H), the attacker can silently alter consent records or privacy preference submissions sent from the browser.
• Confidentiality impact at system scope (SC:H) means sensitive data surfaced through the Fides consent interface is exposed to the attacker-controlled script.