Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-22674

Hashgraph Guardian Stored XSS via branding companyName field

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARD_REGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers can exploit the unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in the browser of every authenticated user on every page load.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

hashgraph guardian

Default version status: affected

  • 0 to ≤ 3.6.0affected
  • ba8c566807848cf84360716438056d8d8d2c8362unaffected
pkg:github/hashgraph/guardian

References