CVE-2021-39167

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
OpenZeppelin	openzeppelin-contracts	>=4.0.0, < 4.3.1; >=3.3.0, < 3.4.2; >= 3.3.0-solc-0.7, < 3.4.2-solc-0.7

References

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md#431Patch, Release Notes, Third Party Advisory
https://github.com/OpenZeppelin/openzeppelin-contracts/commit/cec4f2ef57495d8b1742d62846da212515d99dd5Patch, Third Party Advisory
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-fg47-3c2x-m2wrThird Party Advisory
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md#431Patch, Release Notes, Third Party Advisory
https://github.com/OpenZeppelin/openzeppelin-contracts/commit/cec4f2ef57495d8b1742d62846da212515d99dd5Patch, Third Party Advisory
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-fg47-3c2x-m2wrThird Party Advisory

Timeline

Published: Aug 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-391689.8OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with th CVE-2021-391695.4Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in CVE-2021-39175.5A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. T CVE-2021-391705.4Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a valu CVE-2021-391717.5Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SA CVE-2021-391728.8Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), ca CVE-2021-391738.8Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), can CVE-2021-391748.8Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), ca CVE-2021-391756.1HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript CVE-2021-391767.5detect-character-encoding is a package for detecting character encoding using ICU. In detect-character-encoding v0.3.0 and earlier, allocate CVE-2021-391779.8Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Versions of Geyser prior to 1.4.2-SNAPSHOT allow anyone t CVE-2021-391786.1Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an in