CVE-2026-39911

OVERVIEW Hashgraph Guardian through version 3.5.0 contains an unsandboxed JavaScript execution vulnerability in the Custom Logic policy block worker. The flaw allows authenticated Standard Registry users to execute arbitrary code by passing user-supplied JavaScript expressions directly to the Node.js Function() constructor without proper isolation or sandboxing controls. SEVERITY This vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with a network-based attack vector, low complexity, and low privilege requirements. The impact is severe: authenticated attackers can leverage native Node.js module imports to read arbitrary files from the container filesystem, access process environment variables containing sensitive credentials including RSA private keys and JWT signing keys, and forge valid authentication tokens for any user including administrators. This represents complete compromise of confidentiality, integrity, and availability. EXPLOITATION STATUS There is no current evidence of active exploitation. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is not listed on vulnerability hot lists, indicating limited public awareness and community attention. The EPSS score of 0.00119 suggests low probability of exploitation in the wild compared to other disclosed vulnerabilities. However, the requirement for only Standard Registry user privileges presents a moderate barrier to exploitation in typical deployments.