Hashgraph Guardian contains a stored cross‑site scripting flaw that lets authenticated users with the STANDARD_REGISTRY role submit a crafted companyName value through the branding configuration API endpoint. The vulnerability arises from an unsanitized assignment to innerHTML, allowing an attacker to inject arbitrary JavaScript that executes whenever an authenticated user loads any page. The attack can compromise the confidentiality and integrity of data within the victim's browser session and enable malicious actions such as credential theft or session hijacking. No alteration to the server’s internal state occurs, so the impact is confined to the client side of authenticated sessions.

Hashgraph Guardian up to and including version 3.5.0 is affected. The issue is fixed after the commit ba8c566 in the official repository, so any release incorporating that change is not vulnerable.

The CVSS score of 4.8 represents a medium level of severity. EPSS data is not available and the vulnerability is not listed in CISA KEV, indicating that no widespread exploitation has been identified yet. The likely attack path requires an authenticated session with STANDARD_REGISTRY privileges to submit the malicious companyName value; it is not exploitable by unauthenticated users.