CVE-2024-38537

Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features of Fides, used the `polyfill.io` domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard. Therefore it was possible for users of legacy, pre-2017 browsers who navigate to a page serving `fides.js` to download and execute malicious scripts from the `polyfill.io` domain when the domain was compromised and serving malware. No exploitation of `fides.js` via `polyfill.io` has been identified as of time of publication. The vulnerability has been patched in Fides version `2.39.1`. Users are advised to upgrade to this version or later to secure their systems against this threat. On Thursday, June 27, 2024, Cloudflare and Namecheap intervened at a domain level to ensure `polyfill.io` and its subdomains could not resolve to the compromised service, rendering this vulnerability unexploitable. Prior to the domain level intervention, there were no server-side workarounds and the confidentiality, integrity, and availability impacts of this vulnerability were high. Clients could ensure they were not affected by using a modern browser that supported the fetch standard.

• CWE-829

• https://fetch.spec.whatwg.orgProduct
• https://github.com/ethyca/fides/commit/868c4d629760572192bd61db34f5a4458ed12005Patch
• https://github.com/ethyca/fides/pull/5026Issue Tracking, Patch
• https://github.com/ethyca/fides/security/advisories/GHSA-cvw4-c69g-7v7mPatch, Third Party Advisory
• https://sansec.io/research/polyfill-supply-chain-attackProduct
• https://fetch.spec.whatwg.orgProduct
• https://github.com/ethyca/fides/commit/868c4d629760572192bd61db34f5a4458ed12005Patch
• https://github.com/ethyca/fides/pull/5026Issue Tracking, Patch
• https://github.com/ethyca/fides/security/advisories/GHSA-cvw4-c69g-7v7mPatch, Third Party Advisory
• https://sansec.io/research/polyfill-supply-chain-attackProduct

Published

Jul 2, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-38531Nix is a package manager for Linux and other Unix systems th…3.6
• CVE-2024-38532The NXP Data Co-Processor (DCP) is a built-in hardware modul…7.1
• CVE-2024-38533ZKsync Era is a layer 2 rollup that uses zero-knowledge proo…6.5
• CVE-2024-38534Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-38535Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-38536Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-38538In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2024-38539In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-3854In some code patterns the JIT incorrectly optimized switch s…8.8
• CVE-2024-38540In the Linux kernel, the following vulnerability has been re…4.4
• CVE-2024-38541In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-38542In the Linux kernel, the following vulnerability has been re…7.8