# ethyca-fides (PyPI) vulnerabilities 22 known vulnerabilities (1 critical, 6 high, 7 medium, 7 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.86.2 (Jun 1, 2026): no advisory affects it - Newest unaffected release: 2.86.2 (Jun 1, 2026), the latest release - Weekly downloads: 2,057 - Dependents: 0 - Releases: 500+ since 2.57.0 (Mar 17, 2025) - Registry: https://pypi.org/project/ethyca-fides/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-44541: 2.57.0 to 2.84.5rc0 (2.84.5 is outside it) - CVE-2026-42303: 2.75.0 to 2.83.2rc3 (2.83.2 is outside it) - CVE-2025-57817: 2.57.0 to 2.69.1rc1 (2.69.1 is outside it) - CVE-2025-57816: 2.57.0 to 2.69.1rc1 (2.69.1 is outside it) - CVE-2025-57766: 2.57.0 to 2.69.1rc1 (2.69.1 is outside it) - CVE-2025-57815: 2.57.0 to 2.69.1rc1 (2.69.1 is outside it) - CVE-2024-52008: no published release is affected - CVE-2024-45053: no published release is affected - CVE-2024-45052: no published release is affected - CVE-2024-31223: no published release is affected - CVE-2024-38537: no published release is affected - CVE-2024-35189: no published release is affected - CVE-2024-34715: no published release is affected - CVE-2023-48224: no published release is affected - CVE-2023-47114: no published release is affected - CVE-2023-46124: no published release is affected - CVE-2023-46125: no published release is affected - CVE-2023-46126: no published release is affected - CVE-2023-41319: no published release is affected - CVE-2023-37480: no published release is affected - CVE-2023-37481: no published release is affected - CVE-2023-36827: no published release is affected Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (22) ### [CVE-2026-44541](https://cve.now/CVE-2026-44541): Fides: DOM-based XSS vulnerability in fides.js via fides\_description override - Severity: High 7.0 - Published: Jun 8, 2026 - Affected: from 2.33.0, fixed in 2.84.5. - Fixed in 2.84.5 (released May 7, 2026, 32 days before disclosure). - The latest release, 2.86.2, is not affected. ### [CVE-2026-42303](https://cve.now/CVE-2026-42303): Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection - Severity: Medium 6.1 - Published: May 12, 2026 - Affected: from 2.75.0, fixed in 2.83.2. - Fixed in 2.83.2 (released Apr 21, 2026, 21 days before disclosure). - The latest release, 2.86.2, is not affected. ### [CVE-2025-57817](https://cve.now/CVE-2025-57817): Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation - Severity: High 8.6 - Published: Sep 8, 2025 - Affected: fixed in 2.69.1. - Fixed in 2.69.1 (released Sep 3, 2025, 5 days before disclosure). - The latest release, 2.86.2, is not affected. ### [CVE-2025-57816](https://cve.now/CVE-2025-57816): Fides Webserver API Rate Limiting Vulnerability in Proxied Environments - Severity: Medium 6.3 - Published: Sep 8, 2025 - Affected: fixed in 2.69.1. - Fixed in 2.69.1 (released Sep 3, 2025, 5 days before disclosure). - The latest release, 2.86.2, is not affected. ### [CVE-2025-57766](https://cve.now/CVE-2025-57766): Fides's Admin UI User Password Change Does Not Invalidate Current Session - Severity: Low 1.7 - Published: Sep 8, 2025 - Affected: fixed in 2.69.1. - Fixed in 2.69.1 (released Sep 3, 2025, 5 days before disclosure). - The latest release, 2.86.2, is not affected. ### [CVE-2025-57815](https://cve.now/CVE-2025-57815): Fides Lacks Brute-Force Protections on Authentication Endpoints - Severity: Low 1.7 - Published: Sep 8, 2025 - Affected: fixed in 2.69.1. - Fixed in 2.69.1 (released Sep 3, 2025, 5 days before disclosure). - The latest release, 2.86.2, is not affected. ### [CVE-2024-52008](https://cve.now/CVE-2024-52008): Password Policy Bypass Vulnerability in Fides Webserver - Severity: Low 2.0 - Published: Nov 26, 2024 - Affected: fixed in 2.50.0. - Fixed in 2.50.0. - The latest release, 2.86.2, is not affected. ### [CVE-2024-45053](https://cve.now/CVE-2024-45053): Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine - Severity: Critical 9.1 - Published: Sep 4, 2024 - Affected: from 2.19.0, fixed in 2.44.0. - Fixed in 2.44.0. - The latest release, 2.86.2, is not affected. ### [CVE-2024-45052](https://cve.now/CVE-2024-45052): Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability - Severity: Medium 5.3 - Published: Sep 4, 2024 - Affected: fixed in 2.44.0. - Fixed in 2.44.0. - The latest release, 2.86.2, is not affected. ### [CVE-2024-31223](https://cve.now/CVE-2024-31223): Fides Information Disclosure Vulnerability in Privacy Center of SERVER\_SIDE\_FIDES\_API\_URL - Severity: Medium 5.3 - Published: Jul 3, 2024 - Affected: from 2.19.0, fixed in 2.39.2. - Fixed in 2.39.2. - The latest release, 2.86.2, is not affected. ### [CVE-2024-38537](https://cve.now/CVE-2024-38537): Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js - Severity: None 0.0 - Published: Jul 2, 2024 - Affected: fixed in 2.39.1. - Fixed in 2.39.1. - The latest release, 2.86.2, is not affected. ### [CVE-2024-35189](https://cve.now/CVE-2024-35189): Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides - Severity: Medium 6.5 - Published: May 30, 2024 - Affected: fixed in 2.37.0. - Fixed in 2.37.0. - The latest release, 2.86.2, is not affected. ### [CVE-2024-34715](https://cve.now/CVE-2024-34715): Partial Password Exposure Vulnerability in Fides Webserver Logs - Severity: Low 2.3 - Published: May 29, 2024 - Affected: fixed in 2.37.0. - Fixed in 2.37.0. - The latest release, 2.86.2, is not affected. ### [CVE-2023-48224](https://cve.now/CVE-2023-48224): Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides - Severity: High 8.2 - Published: Nov 15, 2023 - Affected: fixed in 2.24.0. - Fixed in 2.24.0. - The latest release, 2.86.2, is not affected. ### [CVE-2023-47114](https://cve.now/CVE-2023-47114): Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages - Severity: Medium 4.3 - Published: Nov 8, 2023 - Affected: from 2.15.1, fixed in 2.23.3. - Fixed in 2.23.3. - The latest release, 2.86.2, is not affected. ### [CVE-2023-46124](https://cve.now/CVE-2023-46124): Server-Side Request Forgery Vulnerability in Custom Integration Upload - Severity: High 8.2 - Published: Oct 24, 2023 - Affected: fixed in 2.22.1. - Fixed in 2.22.1. - The latest release, 2.86.2, is not affected. ### [CVE-2023-46125](https://cve.now/CVE-2023-46125): Fides Information Disclosure Vulnerability in Config API Endpoint - Severity: Medium 6.5 - Published: Oct 24, 2023 - Affected: fixed in 2.22.1. - Fixed in 2.22.1. - The latest release, 2.86.2, is not affected. ### [CVE-2023-46126](https://cve.now/CVE-2023-46126): Fides JavaScript Injection Vulnerability in Privacy Center URL - Severity: Low 3.9 - Published: Oct 24, 2023 - Affected: fixed in 2.22.1. - Fixed in 2.22.1. - The latest release, 2.86.2, is not affected. ### [CVE-2023-41319](https://cve.now/CVE-2023-41319): Remote Code Execution in Custom Integration Upload in Fides - Severity: High 8.8 - Published: Sep 6, 2023 - Affected: from 2.11.0, fixed in 2.19.0. - Fixed in 2.19.0. - The latest release, 2.86.2, is not affected. ### [CVE-2023-37480](https://cve.now/CVE-2023-37480): Fides Webserver Vulnerable to Zip Bomb File Uploads - Severity: Low 2.7 - Published: Jul 18, 2023 - Affected: from 2.11.0, fixed in 2.16.0. - Fixed in 2.16.0. - The latest release, 2.86.2, is not affected. ### [CVE-2023-37481](https://cve.now/CVE-2023-37481): Fides Webserver Vulnerable to SVG Bomb File Uploads - Severity: Low 2.7 - Published: Jul 18, 2023 - Affected: from 2.11.0, fixed in 2.16.0. - Fixed in 2.16.0. - The latest release, 2.86.2, is not affected. ### [CVE-2023-36827](https://cve.now/CVE-2023-36827): Fides vulnerable to Path Traversal in Webserver API - Severity: High 7.5 - Published: Jul 5, 2023 - Affected: fixed in 2.15.1; fixed in 2.15.1. - Fixed in 2.15.1. - The latest release, 2.86.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/ethyca-fides Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.