CVE-2026-39911

HighCVSS 8.8

Published: 09/04/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

42th percentile - higher than 42% of all known CVEs

Summary

A vulnerability in Hashgraph Guardian up to version 3.5.1 (fixed in commit 45fbe2f) allows unsandboxed JavaScript execution in the Custom Logic policy block. Authenticated Standard Registry users can pass arbitrary JavaScript expressions directly to the Node.js Function() constructor, enabling import of native Node.js modules and reading files from the container filesystem.

Risk Assessment

Attackers can access environment variables containing sensitive credentials such as RSA private keys, JWT signing keys, and API tokens, and forge valid authentication tokens for any user including administrators.

Recommendation

Immediately update Hashgraph Guardian to a version containing commit 45fbe2f or later. Until the update, restrict access to the Custom Logic policy feature to trusted users only.

Other vulnerabilities in Hashgraph Guardian

CVE-2026-22674Medium
Hashgraph Guardian up to version 3.6.0 contains a stored cross-site scripting vulnerability. Authenticated users with the STANDARD_REGISTRY role can inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers exploit unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in every authenticated user's browser on every page load.

Original NVD description (English source)

Hashgraph Guardian through version 3.5.1, fixed in commit 45fbe2f, contains an unsandboxed JavaScript execution vulnerability in the Custom Logic policy block worker that allows authenticated Standard Registry users to execute arbitrary code by passing user-supplied JavaScript expressions directly to the Node.js Function() constructor without isolation. Attackers can import native Node.js modules to read arbitrary files from the container filesystem, access process environment variables containing sensitive credentials such as RSA private keys, JWT signing keys, and API tokens, and forge valid authentication tokens for any user including administrators.