Hashgraph Guardian versions up to and including 3.5.1 permit an unsandboxed evaluation of JavaScript code supplied in the Custom Logic policy block worker. The vulnerability arises when the system feeds user‑created JavaScript expressions directly into Node.js’s Function() constructor without any isolation, allowing the attacker to execute arbitrary code on the hosting node.

Only deployments of Hashgraph Guardian running version 3.5.1 or older are affected. The attack is limited to users who hold an authenticated Standard Registry account, as the vulnerability exists within the Custom Logic policy block used by such users.

The CVSS score of 8.7 indicates a high‑severity flaw. The EPSS score of 0.00119 indicates a very low but non‑zero exploitation probability currently, and the issue is not listed in the CISA KEV catalog. The exploit requires only legitimate Standard Registry credentials and the ability to supply a JavaScript payload. Successful exploitation can read sensitive filesystem material, harvest process environment variables that may contain private keys or tokens, and forge authentication tokens for any user, including administrators, thereby providing full compromise of the node.