CVE-2023-46126 Fides JavaScript Injection Vulnerability in Privacy Center URL
An attacker with contributor privileges can inject JavaScript via privacy policy URLs, executing code on integrated websites.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-46126?
CVE-2023-46126 is a low-severity cross-site scripting vulnerability in ethyca fides, published on 24 Oct 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher. The vulnerability has been patched in Fides version `2.22.1`.
Weakness: CWE-79
Which versions are affected by CVE-2023-46126?
3 open source packages ship an affected version, including ethyca-fides. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ethyca-fides PyPI | All versions | 2.22.1 |
ethyca-fides PyPI | All versions | 2.22.1 |
ethyca-fides PyPI | All versions | 2.22.1 |
Products include Ethyca Fides.
How do I fix CVE-2023-46126?
Upgrade ethyca-fides to 2.22.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-46126 being exploited?
There is no known exploitation of CVE-2023-46126 in the wild and no public exploit code.
Other vulnerabilities in ethyca fides
- CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine
- CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides
- CVE-2025-57817 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation
- CVE-2023-48224 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides
- CVE-2023-46124 Server-Side Request Forgery Vulnerability in Custom Integration Upload
Sources
Also known as GHSA-fgjj-5jmr-gh83, PYSEC-2026-1340.