Executive brief
Hashgraph Guardian, a platform for managing digital environmental assets, contains a security flaw in its branding configuration settings. An authorized user with administrative-level permissions can save a malicious script into the 'company name' field. This script will then automatically run in the web browser of every other user who logs into the system, potentially allowing the attacker to steal session information or perform unauthorized actions on behalf of other users.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Hashgraph Guardian through version 3.6.0. The root cause is the unsanitized use of the 'innerHTML' property when rendering the 'companyName' value from the branding configuration API. Specifically, the branding service in the frontend (branding.service.ts and branding.component.ts) assigns user-controlled data directly to the DOM, bypassing Angular's default XSS protections. An attacker with 'STANDARD_REGISTRY' privileges can submit a crafted payload via a POST request to the /api/v1/branding endpoint. Because the branding service runs from the root application component, the malicious script executes globally for every authenticated user upon page load. The issue is fixed in commit ba8c566 by replacing 'innerHTML' with 'textContent'.
Affected products
- Hashgraph Guardian <= 3.6.0
Timeline
- 2026-06-10: other: Vulnerability reported and PR opened
- 2026-06-15: patched: Fix merged into develop branch
- 2026-06-18: disclosed: CVE published and advisory released