CVE-2026-22674

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22674
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22674.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22674
Published
2026-06-18T21:08:05.431Z
Modified
2026-07-08T08:01:57.983279180Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Hashgraph Guardian Stored XSS via branding companyName field
Details

Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARD_REGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers can exploit the unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in the browser of every authenticated user on every page load.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22674.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/hashgraph/guardian

Affected ranges

Type
GIT
Repo
https://github.com/hashgraph/guardian
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
39f5fdf8b6ea9f10779140e24b03b79ab2799a93
Fixed
ba8c566807848cf84360716438056d8d8d2c8362
Database specific 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.6.0"
        }
    ]
}

Affected versions

3.*
3.4.0
3.4.1
3.5.0
3.5.0-rc
3.5.1
3.6.0-rc
v1.*
v1.0.0
v1.0.0-beta.1
v2.*
v2.24.0
v2.24.1
v2.25.0
v2.25.1
v2.26.0
v2.26.1
v2.26.2
v2.27.0
v2.27.1
v3.*
v3.0.0
v3.1.0
v3.1.0-RC
v3.1.1
v3.2.0
v3.2.0-RC
v3.2.0-rc
v3.3.0
v3.3.0-rc
v3.4.0-rc

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22674.json"