Read the docs
TI-2026-28783 Aliases CVE-2026-39911GHSA-wf7f-q2xr-hrmh

Hashgraph Guardian 3.5.1 Unsandboxed JavaScript Execution RCE

Priority MEDIUM 40CWE-668Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Hashgraph Guardian through version 3.5.1, fixed in commit 45fbe2f, contains an unsandboxed JavaScript execution vulnerability in the Custom Logic policy block worker that allows authenticated Standard Registry users to execute arbitrary code by passing user-supplied JavaScript expressions directly to the Node.js Function() constructor without isolation. Attackers can import native Node.js modules to read arbitrary files from the container filesystem, access process environment variables containing sensitive credentials such as RSA private keys, JWT signing keys, and API tokens, and forge valid authentication tokens for any user including administrators.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00554 46th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hashgraphguardianup to 3.5.1—Patch availableCNA
  • guardian Vendorhashgraph Affected up to 3.5.1 Fixed in — Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hedera:guardian:*:*:*:*:*:*:*:*up to 3.5.0VulnerableHedera
  • cpe:2.3:a:hedera:guardian:*:*:*:*:*:*:*:* Versions up to 3.5.0 Vulnerable ·Hedera

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39911
  2. 2026-10-03 Alias added: GHSA-wf7f-q2xr-hrmh
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 2

  • TI-2026-18202 Hashgraph Guardian Stored XSS via branding companyName field CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences