CVE-2021-39168 json
TimelockController vulnerability in OpenZeppelin Contracts
published 5y ago modified 4mo ago also GHSA-vrw4-w73r-6mm8 , EUVD-2021-1903
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.
Patch / fix
- npm @openzeppelin/contracts-upgradeable 3.4.2, 4.3.1
- openzeppelin contracts 3.4.2, 4.3.1
Is CVE-2021-39168 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
1.59% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @openzeppelin/contracts-upgradeable | >=4.0.0, <4.3.1 >=3.3.0, <3.4.2 |
4.3.1 3.4.2 |
Affected products
- OpenZeppelin openzeppelin-contracts-upgradeable
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
github.com
/OpenZeppelin/openzeppelin-contracts/commit/cec4f2ef57495d8b1742d62846da212515d99dd5
web, patch, third-party-advisory
-
github.com
/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md#431
web, patch, release-notes, third-party-advisory
-
github.com
/OpenZeppelin/openzeppelin-contracts-upgradeable/security/advisories/GHSA-vrw4-w73r-6mm8
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-39168
advisory
-
github.com
/OpenZeppelin/openzeppelin-contracts-upgradeabl
package
Sources
- CVE List CVE-2021-39168
- GitHub Advisory GHSA-vrw4-w73r-6mm8
- NVD CVE-2021-39168
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.