https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:38:18 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44541 <p><strong>Affected:</strong> ethyca fides</p> <p>Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.</p> <p><strong>Affected:</strong> ethyca fides</p> <p>Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.</p> https://cve.radiocsirt.org/vuln/cve-2026-44541 https://cve.radiocsirt.org/vuln/ghsa-5qrq-9645-g5g2 <p><strong>Affected:</strong> PyPI: ethyca-fides</p> <p>### Summary</p> <p>`fides.js` is the script that renders Fides&#39;s consent banner on customer websites. It lets the embedding page override the banner&#39;s description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the overridden value is rendered as live HTML without passing through the server-side sanitiser the rendering path was designed to trust.</p> <p>The result is a DOM-based XSS that any visitor can trigger with a crafted link, no authentication required. The cookie source lets the payload persist, so a single click can plant a payload that fires on every subsequent banner render across all subdomains until cookies are cleared.</p> <p>### Am I affected?</p> <p>This vulnerability affects Fides Enterprise deployments that use `fides.js` for consent management, a.k.a. &#34;Janus&#34;, and have HTML-formatted banner descriptions enabled (the `FIDES_PRIVACY_CENTER__ALLOW_HTML_DESCRIPTION` Privacy Center container env var set to `true` ). Deployments that do not load `fides.js`, or that leave HTML descriptions off (the default), are not affected. The vulnerable code lives in the open-source `ethyca-fides` PyPI package, which is why this is published as a GHSA and CVE against Fides OSS, but only Fides Enterprise consent management platform deployments exercise the affected path.</p> <p>To self-test, visit any page where your site loads the consent banner, replacing `&lt;your-site&gt;`:</p> <p>``` https://&lt;your-site&gt;/?fides_override_language…</p> <p><strong>Affected:</strong> PyPI: ethyca-fides</p> <p>### Summary</p> <p>`fides.js` is the script that renders Fides&#39;s consent banner on customer websites. It lets the embedding page override the banner&#39;s description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the overridden value is rendered as live HTML without passing through the server-side sanitiser the rendering path was designed to trust.</p> <p>The result is a DOM-based XSS that any visitor can trigger with a crafted link, no authentication required. The cookie source lets the payload persist, so a single click can plant a payload that fires on every subsequent banner render across all subdomains until cookies are cleared.</p> <p>### Am I affected?</p> <p>This vulnerability affects Fides Enterprise deployments that use `fides.js` for consent management, a.k.a. &#34;Janus&#34;, and have HTML-formatted banner descriptions enabled (the `FIDES_PRIVACY_CENTER__ALLOW_HTML_DESCRIPTION` Privacy Center container env var set to `true` ). Deployments that do not load `fides.js`, or that leave HTML descriptions off (the default), are not affected. The vulnerable code lives in the open-source `ethyca-fides` PyPI package, which is why this is published as a GHSA and CVE against Fides OSS, but only Fides Enterprise consent management platform deployments exercise the affected path.</p> <p>To self-test, visit any page where your site loads the consent banner, replacing `&lt;your-site&gt;`:</p> <p>``` https://&lt;your-site&gt;/?fides_override_language…</p> https://cve.radiocsirt.org/vuln/ghsa-5qrq-9645-g5g2