Read the docs
TI-2021-16554 Aliases CVE-2021-39168GHSA-vrw4-w73r-6mm8

TimelockController vulnerability in OpenZeppelin Contracts

Priority MEDIUM 46CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.

Why it matters now

EPSS 0.0159 75th percentileScored 2026-11-07
Fix Fixed openzeppelin-contracts-upgradeable (OpenZeppelin): 4.3.1, 3.4.2, 3.4.2-solc-0.7@openzeppelin/contracts-upgradeable (npm): 4.3.1, 3.4.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenZeppelinopenzeppelin-contracts-upgradeable4.0.0 to before 4.3.1; 3.3.0 to before 3.4.2; 3.3.0-solc-0.7 to before 3.4.2-solc-0.74.3.1, 3.4.2, 3.4.2-solc-0.7Patch availableCNA
—@openzeppelin/contracts-upgradeable (npm)4.0.0 to before 4.3.14.3.1Patch availableGHSA-vrw4-w73r-6mm8
—@openzeppelin/contracts-upgradeable (npm)3.3.0 to before 3.4.23.4.2Patch availableGHSA-vrw4-w73r-6mm8
  • openzeppelin-contracts-upgradeable VendorOpenZeppelin Affected 4.0.0 to before 4.3.1; 3.3.0 to before 3.4.2; 3.3.0-solc-0.7 to before 3.4.2-solc-0.7 Fixed in 4.3.1, 3.4.2, 3.4.2-solc-0.7 Patch available CNA
  • @openzeppelin/contracts-upgradeable (npm) Vendor— Affected 4.0.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-vrw4-w73r-6mm8
  • @openzeppelin/contracts-upgradeable (npm) Vendor— Affected 3.3.0 to before 3.4.2 Fixed in 3.4.2 Patch available GHSA-vrw4-w73r-6mm8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*3.3.0 to before 3.4.2; 4.0.0 to before 4.3.1VulnerableOpenZeppelin
  • cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:* Versions 3.3.0 to before 3.4.2; 4.0.0 to before 4.3.1 Vulnerable ·OpenZeppelin

Remediation

  • Fix · CNA openzeppelin-contracts-upgradeable (OpenZeppelin) Fixed in 4.3.1, 3.4.2, 3.4.2-solc-0.7
  • Fix · GHSA-vrw4-w73r-6mm8 @openzeppelin/contracts-upgradeable (npm) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-vrw4-w73r-6mm8 @openzeppelin/contracts-upgradeable (npm) Fixed in 3.4.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39168
  2. 2026-10-03 Alias added: GHSA-vrw4-w73r-6mm8

References

Patch 2

Advisory 2

Other 1

  • TI-2022-13196 OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli CVSS 3.1MEDIUM 6.5
  • TI-2021-16553 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
  • TI-2021-18096 UUPSUpgradeable vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 9.8
  • TI-2022-13238 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts CVSS 3.1HIGH 7.5
  • TI-2022-13212 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false CVSS 3.1HIGH 7.5
  • TI-2023-14377 GovernorCompatibilityBravo may trim proposal calldata CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences