Threats tagged 'ghsa-wf7f-q2xr-hrmh'

Hashgraph Guardian versions up to 3.5.0 have a vulnerability in the Custom Logic policy block worker that allows authenticated Standard Registry users to execute arbitrary JavaScript code without sandboxing. This flaw enables attackers to import native Node.js modules, read sensitive files, access environment variables containing credentials, and forge authentication tokens for any user, including administrators.