Fides JavaScript Injection Vulnerability in Privacy Center URL
Summary
CVE-2023-46126: Fides JavaScript Injection Vulnerability in Privacy Center URL. Affects ethyca-fides versions < 2.22.1. Fixed in 2.22.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fides is a web application that allows users to edit consent and privacy notices, such as cookie banners. These privacy notices can be served by integrated websites. One of the editable fields in Fides is the privacy policy URL, which was found to lack proper validation. This vulnerability allows an attacker to inject malicious JavaScript code into the privacy policy URL, triggering its execution when the privacy notice is served by an integrated website. The executed JavaScript code operates within the domain scope of the integrated website. This vulnerability can only be exploited by Admin UI users with the contributor role or higher.
Vulnerability Detail
The Fides web application is vulnerable to JavaScript injection in the privacy policy URL field. By crafting a payload in the privacy policy URL, an attacker can execute arbitrary JavaScript code when the privacy notice is displayed on an integrated website. The impact of this vulnerability is limited to the domain scope of the integrated website. Exploitation requires the attacker to have Admin UI access with the contributor role or higher.
How To Fix
Latest published version: 2.86.2 as of 22 Oct 2026
pip install --upgrade "ethyca-fides==2.86.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.22.1
This is the first release that contains the fix.
pip install --upgrade "ethyca-fides==2.22.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. Upgrading to the patched version is the recommended solution.
Conclusion
The Fides web application is vulnerable to JavaScript injection in the privacy policy URL field. Upgrading to version 2.22.1 or later is recommended to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ethyca-fides →
FAQ
Fides is a web application that allows users to edit consent and privacy notices, such as cookie banners.
The vulnerability allows an attacker to inject JavaScript code into the privacy policy URL, which is executed when the privacy notice is served by an integrated website.
This vulnerability can only be exploited by Admin UI users with the contributor role or higher.
To fix this vulnerability, upgrade to Fides version 2.22.1 or later.
No, there are no known workarounds for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ethyca-fides.
