Hashgraph Guardian contains a critical remote code execution vulnerability that allows authenticated users to compromise sensitive credentials and forge administrative tokens.

The software fails to isolate user-supplied JavaScript expressions passed to the Node.js Function constructor within the Custom Logic policy block. This allows an authenticated Standard Registry user to escape the intended execution environment to access native Node.js modules and sensitive filesystem resources.

The ability to execute arbitrary code with the privileges of the application process poses a severe risk to the entire Hashgraph Guardian deployment. An attacker can exfiltrate sensitive environment variables, including RSA private keys and JWT signing keys, enabling the forgery of administrative authentication tokens. Given the CVSS score of 8.8, this vulnerability represents a high risk of total system compromise and unauthorized data access.

Immediate Action: Update Hashgraph Guardian to a version containing the fix implemented in commit 45fbe2f7e0e8feee30105d42d66ed63fb6177ebe.

Proactive Monitoring: Review application logs for suspicious activity within the Custom Logic policy block and monitor for unauthorized access to sensitive environment variables or unusual process behavior.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the impact if a container is compromised, and ensure that the application process runs with the least privileges necessary.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the integrity and confidentiality of the Hashgraph Guardian platform. Security teams must prioritize updating the software to the patched version immediately to prevent unauthorized code execution and potential administrative account takeovers. If an immediate update is not feasible, restrict access to the Custom Logic policy block to only the most trusted users until the patch can be applied.