PT-2026-31677 · Unknown · Hashgraph Guardian

Christ Bouchuen · Published 2026-04-09 · Updated 2026-05-01 · CVE-2026-39911

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hashgraph Guardian versions through 3.5.0

Description Hashgraph Guardian through version 3.5.0 has an unsandboxed JavaScript execution issue in the Custom Logic policy block worker. Authenticated Standard Registry users can execute arbitrary code by supplying JavaScript expressions directly to the Node.js Function() constructor without isolation. This allows attackers to import native Node.js modules to read arbitrary files from the container filesystem, access process environment variables containing sensitive credentials such as RSA private keys, JWT signing keys, and API tokens, and forge valid authentication tokens for any user, including administrators.

Recommendations Update to a version later than 3.5.0.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2026-39911

Affected Products

Hashgraph Guardian

References · 6

• https://github.com/hashgraph/guardian/commit/45fbe2f7e0e8feee30105d42d66ed63fb6177ebe · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39911 · Security Note
• https://github.com/hashgraph/guardian/pull/5929 · Note
• https://twitter.com/CveFindCom/status/2042312317698769301 · Twitter Post
• https://t.me/cveNotify/161782 · Telegram Post
• https://vulncheck.com/advisories/hashgraph-guardian-unsandboxed-javascript-execution-rce · Note