CVE-2026-39911 - Vulnerability Analysis

Overview

Hashgraph Guardian through version 3.5.0 contains an unsandboxed JavaScript execution vulnerability in the Custom Logic policy block worker, letting authenticated Standard Registry users execute arbitrary code and access sensitive data, exploit requires authentication.

Severity & Score

Impact

Authenticated users can execute arbitrary code, read sensitive files, and forge authentication tokens, leading to full system compromise.

Mitigation

Update to a version later than 3.5.0 or the latest available version.

References

• https://github.com/hashgraph/guardian/pull/5929
• https://www.vulncheck.com/advisories/hashgraph-guardian-unsandboxed-javascript-execution-rce

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 12, 2026

🟠 CVE-2026-39911 - High (8.8) Hashgraph Guardian through version 3.5.0 contains an unsandboxed JavaScript execution vulnerability in the Custom Logic policy block worker that allows authenticated Standard Registry users to execute arbitrary code by passing user-supplied JavaSc... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39911/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner