PT-2026-50797 · Hashgraph · Guardian

Christ Bouchuen · Publicado 2026-06-18 · Atualizado 2026-06-18 · CVE-2026-22674

NVD

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Hashgraph Guardian through 3.5.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARD REGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers can exploit the unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in the browser of every authenticated user on every page load.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-22674

Produtos afetados

Guardian

Referências · 4

• https://github.com/hashgraph/guardian/commit/ba8c566807848cf84360716438056d8d8d2c8362 · Correção
• https://github.com/hashgraph/guardian/pull/6190 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22674 · Nota de Segurança
• https://vulncheck.com/advisories/hashgraph-guardian-stored-xss-via-branding-companyname-field · Nota