CVE-2026-22674

Hashgraph Guardian Stored XSS via branding companyName field

CVSS 4.8 MEDIUMEPSS 0.2%CWE-79

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.8EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

18 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARD_REGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers can exploit the unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in the browser of every authenticated user on every page load.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected products

hashgraph · guardian

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/hashgraph/guardian/commit/ba8c566807848cf84360716438056d8d8d2c8362 https://github.com/hashgraph/guardian/pull/6190 https://www.vulncheck.com/advisories/hashgraph-guardian-stored-xss-via-branding-companyname-field