PatchSiren cyber security CVE debrief
CVE-2026-22674 hashgraph CVE debrief
CVE-2026-22674 details a stored cross-site scripting vulnerability in Hashgraph Guardian through version 3.6.0. The vulnerability allows authenticated users with the STANDARD_REGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers can exploit the unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in the browser of every authenticated user on every page load. This issue was fixed in commit ba8c566.
- Vendor
- hashgraph
- Product
- guardian
- CVSS
- MEDIUM 4.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-18
- Original CVE updated
- 2026-06-23
- Advisory published
- 2026-06-18
- Advisory updated
- 2026-06-23
Who should care
Users of Hashgraph Guardian version 3.6.0 or earlier should apply the fix from commit ba8c566. Authenticated users with the STANDARD_REGISTRY role are at risk of being exploited. Operators, security teams, and platform administrators should review and apply mitigations.
Technical summary
The vulnerability exists due to unsanitized innerHTML assignment in the branding service of Hashgraph Guardian. An attacker with the STANDARD_REGISTRY role can submit a crafted companyName value via the branding configuration API endpoint, leading to the execution of arbitrary JavaScript in the browsers of authenticated users. This occurs because user input is not properly sanitized before being used in the innerHTML assignment.
Defensive priority
Medium priority due to the CVSS score of 4.8 and the requirement for authentication with the STANDARD_REGISTRY role.
Recommended defensive actions
- Apply the fix from commit ba8c566 to Hashgraph Guardian installations
- Restrict access to the branding configuration API endpoint
- Monitor for suspicious activity related to authenticated users with the STANDARD_REGISTRY role
- Implement additional security measures to prevent cross-site scripting attacks
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-06-18T22:16:30.117Z and last modified on 2026-06-23T15:16:00.660Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD details. Defenders should verify product deployments and configurations.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-18T22:16:30.117Z and has not been modified since then. The NVD entry is currently Deferred.