CVE-2026-39911 is a high-severity vulnerability in Hashgraph Guardian through version 3.5.1. It arises from unsandboxed JavaScript execution in the Custom Logic policy block worker, where user-supplied JavaScript expressions are passed directly to the Node.js Function() constructor without isolation. Authenticated Standard Registry users can exploit this to execute arbitrary code, import native Node.js modules, read arbitrary container filesystem files, access sensitive environment variables (including RSA private keys, JWT signing keys, and API tokens), and forge valid authentication tokens for any user, including administrators. The vulnerability is fixed in commit 45fbe2f, but no official patch or vendor advisory is provided in the input data.

Exploitation allows authenticated users with Standard Registry privileges to execute arbitrary code within the application context. Attackers can access sensitive files and environment variables containing critical credentials, such as private keys and API tokens, and can forge authentication tokens for any user, including administrators. This leads to a complete compromise of the application and potentially the underlying system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in commit 45fbe2f, indicating a code-level fix exists. Until an official patch or update is released, restrict Standard Registry user privileges and avoid exposing the vulnerable Custom Logic policy block worker to untrusted users. Monitor vendor channels for an official fix.