Security
فارسی
All products

@openzeppelin/contracts

npm · Package
21 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunningCVE-2023-34234 · GHSA-5H3X-9WVQ-W4M2 @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported
OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific treesCVE-2023-34459 · GHSA-WPRV-93R4-JJ2P @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported
OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegatedCVE-2023-30541 · GHSA-MX2Q-35M2-X2RH @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported
OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4CVE-2023-49798 · GHSA-699G-Q6QH-Q4V8 @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported
TimelockController vulnerability in OpenZeppelin Contracts CVE-2021-39167 · GHSA-FG47-3C2X-M2WR @openzeppelin/contracts npm Critical Fix reported
UUPSUpgradeable vulnerability in @openzeppelin/contractsCVE-2021-41264 · GHSA-5VP3-V4HC-GX76 @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Critical Fix reported
OpenZeppelin Contracts base64 encoding may read from potentially dirty memoryCVE-2024-27094 · GHSA-9VX6-7XXF-X967 @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported
OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffersCVE-2025-54070 · GHSA-9RCW-C2F9-2J55 @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported
OpenZeppelin Contracts vulnerable to Improper Escaping of OutputCVE-2023-40014 · GHSA-G4VP-M682-QQMP @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported
GovernorCompatibilityBravo may trim proposal calldataCVE-2023-30542 · GHSA-93HQ-5WGC-JC82 @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm High Fix reported
OpenZeppelin Contracts contains Incorrect CalculationCVE-2023-26488 · GHSA-878M-3G6Q-594Q @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported
OpenZeppelin Contracts vulnerable to ECDSA signature malleabilityCVE-2022-35961 · GHSA-4H98-2769-GH6H @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm High Fix reported
OpenZeppelin Contracts ERC165Checker unbounded gas consumptionCVE-2022-35915 · GHSA-7GRF-83VW-6F5X @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported
OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain callsCVE-2022-35916 · GHSA-9J3M-G383-29QR @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported
OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposalsCVE-2022-31198 · GHSA-XRC4-737V-9Q75 @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm High Fix reported
OpenZeppelin Contracts's ERC165Checker may revert instead of returning falseCVE-2022-31170 · GHSA-QH9X-GCFH-PCRW @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm High Fix reported
OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signersCVE-2022-31172 · GHSA-4G63-C64M-25W9 @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm High Fix reported
Improper Initialization in OpenZeppelinCVE-2021-46320 · GHSA-88G8-F5MF-F5RJ @openzeppelin/contracts npm High Fix reported
OpenZeppelin Contracts initializer reentrancy may lead to double initializationCVE-2022-39384 · GHSA-9C22-PWXW-P6HX @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported
GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behaviorGHSA-M6W8-FQ7V-PH4M @openzeppelin/contracts-upgradeable@openzeppelin/contracts npm Medium Fix reported