PT-2026-50797 · Unknown · Hashgraph Guardian

Christ Bouchuen · CVE-2026-22674 · Published 2026-06-18 · Updated 2026-06-23

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hashgraph Guardian versions prior to 3.5.0 commit ba8c566

Description A stored cross-site scripting issue exists where authenticated users with the STANDARD REGISTRY role can inject malicious scripts. This occurs by submitting a crafted companyName value through the branding configuration API endpoint. The flaw is caused by an unsanitized innerHTML assignment in the branding service, which allows arbitrary JavaScript to execute in the browser of every authenticated user upon every page load.

Recommendations Update to the version containing commit ba8c566. Restrict the use of the companyName variable in the branding configuration API endpoint until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22674

Affected Products

Hashgraph Guardian

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22674.json · Exploit
• https://github.com/hashgraph/guardian/commit/ba8c566807848cf84360716438056d8d8d2c8362 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22674 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22674 · Vendor Advisory
• https://github.com/hashgraph/guardian · Note
• https://github.com/hashgraph/guardian/pull/6190 · Note
• https://vulncheck.com/advisories/hashgraph-guardian-stored-xss-via-branding-companyname-field · Note
• https://t.me/cveNotify/170793 · Telegram Post
• https://t.me/cveNotify/171575 · Telegram Post
• https://t.me/CVEtracker/57299 · Telegram Post
• https://t.me/cveNotify/172711 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2067845105751376314 · Twitter Post