Read the docs
TI-2022-13196 Aliases CVE-2022-31153GHSA-8mjr-jr5h-q2xr

OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli

Priority MEDIUM 62CWE-664Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework. This bug has been patched in v0.2.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01455 73rd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed openzeppelin-cairo-contracts (PyPI): 0.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenZeppelincairo-contracts= 0.2.0—No fix listedCNA
—openzeppelin-cairo-contracts (PyPI)before 0.2.10.2.1Patch availableGHSA-8mjr-jr5h-q2xr
  • cairo-contracts VendorOpenZeppelin Affected = 0.2.0 Fixed in — No fix listed CNA
  • openzeppelin-cairo-contracts (PyPI) Vendor— Affected before 0.2.1 Fixed in 0.2.1 Patch available GHSA-8mjr-jr5h-q2xr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openzeppelin:contracts:0.2.0:*:*:*:*:cairo:*:*0.2.0VulnerableOpenZeppelin
  • cpe:2.3:a:openzeppelin:contracts:0.2.0:*:*:*:*:cairo:*:* Versions 0.2.0 Vulnerable ·OpenZeppelin

Remediation

  • Fix · GHSA-8mjr-jr5h-q2xr openzeppelin-cairo-contracts (PyPI) Fixed in 0.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31153
  2. 2026-10-03 Alias added: GHSA-8mjr-jr5h-q2xr

References

Exploit 2

Patch 2

Advisory 3

Other 2

  • TI-2021-16554 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
  • TI-2021-16553 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
  • TI-2021-18096 UUPSUpgradeable vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 9.8
  • TI-2022-13238 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts CVSS 3.1HIGH 7.5
  • TI-2022-13212 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false CVSS 3.1HIGH 7.5
  • TI-2023-14377 GovernorCompatibilityBravo may trim proposal calldata CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences