CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

9 matches found

PyPA•added 2026/07/13 3:19 p.m.•32 views

ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override

Summaryfides.js is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the overridd...

7CVSS6.3AI score0.00517EPSS

SaveExploits0References7Affected Software1

Github Security Blog•added 2026/05/14 7:04 p.m.•25 views

ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override

Summary fides.js is the script that renders Fides's consent banner on customer websites. It lets the embedding page override the banner's description text at runtime via a URL query parameter, a JavaScript global, or a cookie. On sites that have opted into HTML-formatted descriptions, the...

7CVSS6AI score0.00517EPSS

SaveExploits0References5Affected Software1

Snyk•added 2026/05/14 7:04 p.m.•12 views

Cross-site Scripting (XSS)

Overview ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the fides.js script's override mechanism for the banner description field when HTML-formatted descriptions are enabled. An attacker can...

8.7CVSS5.9AI score0.00517EPSS

SaveExploits0References2

Positive Technologies•added 2026/05/14 12:00 a.m.•43 views

PT-2026-41138

Name of the Vulnerable Software and Affected Versions Fides versions 2.33.0 through 2.84.4 Description A DOM-based Cross-Site Scripting XSS issue exists in fides.js, the script used to render consent banners. The problem occurs when the fides description variable is overridden via a URL query...

7CVSS5.9AI score0.00517EPSS

SaveExploits0References13