The vulnerability is DOM‑based XSS originating from the fides_description override in fides.js. An attacker who can influence the fides_description field can inject arbitrary script payloads which will be executed in the victim's browser context. This allows the attacker to hijack user sessions, deface the site, or exfiltrate sensitive data. The flaw corresponds to CWE‑79.

The issue affects the open‑source privacy engineering platform Fides as distributed by the vendor ethyca. Versions from 2.33.0 up to but not including 2.84.5 are vulnerable. All installations that use the publicly exposed fides_description override in fides.js are at risk.

The CVSS score is 7 indicating a moderate‑to‑high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. While the precise likelihood of exploitation is unknown, the attack vector is likely web‑based; any party able to set the fides_description value on a vulnerable instance could trigger the XSS. No additional conditions are required beyond the ability to influence that field.