CVE-2023-47114: Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages
Summary
CVE-2023-47114: Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages. Affects ethyca-fides versions >= 2.15.1, < 2.23.3. Fixed in 2.23.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ethyca Fides is a web application that allows data subject users to request access to their personal data. Once approved by the data controller user, the requested data is retrieved from connected systems and data stores and bundled into a data subject access request package. This package can be downloaded by the data subject user and commonly includes HTML files. However, the application does not validate input from connected systems and data stores, leading to a vulnerability that allows HTML injection. This can be exploited for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the file:// protocol.
Vulnerability Detail
The vulnerability arises due to the lack of input validation in the Fides web application. This allows for HTML injection, which can be abused for phishing attacks or executing malicious JavaScript code. However, exploitation is limited to rogue Admin UI users, malicious connected system/data store users, or data subject users who are tricked into submitting malicious data themselves. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 2.86.2 as of 22 Oct 2026
pip install --upgrade "ethyca-fides==2.86.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.23.3
This is the first release that contains the fix.
pip install --upgrade "ethyca-fides==2.23.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Only Fides deployments using html as the package format in the storage destination are vulnerable. Switching to json or csv eliminates this vulnerability.
Conclusion
The Ethyca Fides web application is vulnerable to HTML injection in HTML-formatted DSR packages. This can lead to phishing attacks or execution of malicious JavaScript code. Users should upgrade to the patched version and consider switching to alternative package formats to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ethyca-fides →
FAQ
Ethyca Fides is a web application that allows data subject users to request access to their personal data.
The vulnerability allows for HTML injection, which can be exploited for phishing attacks or executing malicious JavaScript code.
Exploitation is limited to rogue Admin UI users, malicious connected system/data store users, or data subject users who are tricked into submitting malicious data themselves.
Yes, the vulnerability has been patched in Fides version TBC.
Users are advised to upgrade to Fides version TBC or later to protect against this vulnerability. Additionally, switching to json or csv as the package format eliminates the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ethyca-fides.
