CVE-2026-22674
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Hashgraph Guardian up to version 3.6.0 contains a stored cross-site scripting vulnerability. Authenticated users with the STANDARD_REGISTRY role can inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers exploit unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in every authenticated user's browser on every page load.
Risk Assessment
The risk involves potential session theft, credential harvesting, or unauthorized actions in the context of every authenticated user. This attack can lead to confidentiality and integrity breaches across the organization.
Recommendation
Immediately update Hashgraph Guardian to a version containing commit ba8c566 or later. Additionally, implement input validation and sanitization for all branding configuration API fields.
Other vulnerabilities in Hashgraph Guardian
Original NVD description (English source)
Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARD_REGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers can exploit the unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in the browser of every authenticated user on every page load.