Vulnerability · Published Jun 18, 2026 · Assigned by VulnCheck

CVE-2026-22674Hashgraph Guardian Stored XSS via branding companyName field

Medium 4.8

In plain English

A medium-severity cross-site scripting in guardian from hashgraph. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.3%top 76.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARD_REGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers can exploit the unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in the browser of every authenticated user on every page load.

Affected products (as reported)

Vendor	Product	Versions
hashgraph	guardian	0 – through 3.6.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/hashgraph/guardian/pull/6190 issue-tracking
https://github.com/hashgraph/guardian/commit/ba8c566807848cf84360716438056d8d8d2c8362 patch
https://www.vulncheck.com/advisories/hashgraph-guardian-stored-xss-via-branding-companyname-field third-party-advisory