CVE-2023-46126 json
Fides JavaScript Injection Vulnerability in Privacy Center URL
published 2023-10-24 3 y ago modified 2026-09-10 1 mo ago also GHSA-fgjj-5jmr-gh83 , PYSEC-2026-1340 , EUVD-2023-2724
- cvss
- 3.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher. The vulnerability has been patched in Fides version `2.22.1`.
Patch / fix
- pypi ethyca-fides 2.22.1
- ethyca fides 2.22.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.9 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 3.9 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L |
| OSV | 3.1 | 3.9 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | ethyca-fides | <2.22.1 |
2.22.1 |
Affected products
- ethyca fides
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/ethyca/fides/commit/3231d19699f9c895c986f6a967a64d882769c506
web, patch
-
github.com
/ethyca/fides/security/advisories/GHSA-fgjj-5jmr-gh83
web, third-party-advisory
-
github.com
/ethyca/fides/releases/tag/2.22.1
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-46126
advisory
-
github.com
/ethyca/fides
package
-
pypi.org
/project/ethyca-fides
package
-
github.com
/advisories/GHSA-fgjj-5jmr-gh83
advisory
Sources
- CVE List CVE-2023-46126
- GitHub Advisory GHSA-fgjj-5jmr-gh83
- NVD CVE-2023-46126
- OSV PYSEC-2026-1340
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.