EUVD-2026-37952
GHSA-jqx7-93j3-2xqf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires STANDARD_REGISTRY role (PR:H); stored payload auto-executes on victim page load (UI:R); scope changes to victims' browsers (S:C); low confidentiality and integrity impact consistent with XSS session exposure.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Hashgraph Guardian through 3.5.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARD_REGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers can exploit the unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in the browser of every authenticated user on every page load.
AnalysisAI
Stored cross-site scripting in Hashgraph Guardian through 3.5.0 allows an authenticated user holding the STANDARD_REGISTRY role to inject persistent JavaScript payloads into the branding configuration's companyName field via the branding API endpoint. The injected script executes in every authenticated user's browser on every page load due to unsanitized innerHTML assignments in both the BrandingService and BrandingComponent Angular classes. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the fix diff is publicly visible in GitHub PR #6190, lowering the barrier for exploit development.
Technical ContextAI
Hashgraph Guardian is a blockchain governance platform built with an Angular frontend. The vulnerable code resides in two Angular TypeScript files: frontend/src/app/services/branding.service.ts and frontend/src/app/views/branding/branding.component.ts. In both files, user-controlled data retrieved from the branding configuration API was assigned directly to a DOM element using innerHTML, a pattern classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting). The innerHTML property parses and renders HTML including embedded script tags and event handlers, whereas the safe alternative textContent treats the value as literal text. The fix in commit ba8c566 replaces all three innerHTML assignments with textContent across both files. CPE cpe:2.3:a:hashgraph:guardian:*:*:*:*:*:*:*:* confirms the vulnerable scope spans all Guardian versions through 3.5.0 with no version floor.
RemediationAI
The primary fix is to apply commit ba8c566807848cf84360716438056d8d8d2c8362 (GitHub PR #6190), which replaces all three unsafe innerHTML assignments with textContent in branding.service.ts and branding.component.ts. Note that only the commit hash is confirmed - a formally tagged patched release version has not been independently verified at time of analysis; operators should track the Guardian release changelog to confirm when this commit ships in a versioned release. As an immediate compensating control, audit and restrict the STANDARD_REGISTRY role assignment: remove it from any accounts that do not require branding configuration authority, as this role is the sole exploitation prerequisite. A WAF rule rejecting HTML angle brackets or script-related keywords in the branding API's companyName parameter could provide a secondary layer, but filter bypass is feasible and should not substitute for the code fix. See the VulnCheck advisory at https://www.vulncheck.com/advisories/hashgraph-guardian-stored-xss-via-branding-companyname-field for additional guidance.
OS command injection in Guardian language-system lets unauthenticated remote attackers run arbitrary shell commands by i
Remote code execution in Guardian language-system allows unauthenticated attackers to run arbitrary OS commands by injec
Unauthenticated SQL injection in Guardian Language System lets remote attackers manipulate the backend database by injec
Error-based SQL injection in Guardian Language-System allows a network-accessible authenticated attacker to extract the
SQL injection in Guardian Language-System's designer.php (line 124) allows attackers to extract, modify, or destroy the
Error-based SQL injection in Guardian language-system's subtitles.php exposes full database contents to low-privileged a
Error-based SQL injection in Guardian Language-System exposes the full database to low-privileged authenticated attacker
Error-based SQL injection in Guardian language-system's text_file.php exposes the full database to extraction via a triv
SQL injection in Guardian language-system's media.php endpoint allows low-privilege authenticated attackers to extract t
Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection. Rated high severity (CVSS 7
Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to
A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields us
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today