CVE-2026-22674CWE-79

Hashgraph Guardian Stored XSS via branding companyName field

Medium · published June 18, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
22.6
In the wild
Unconfirmed
What it is

Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARD_REGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers can exploit the unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in the browser of every authenticated user on every page load.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00309 · 22.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-18T21:08Z
EPSS history
Timeline
  • 18 JUN 21:08Z
    Hashgraph Guardian Stored XSS via branding companyName field
    cvelistv5