https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 10:35:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-30454 EUVD-2026-30454 https://cve.radiocsirt.org/vuln/euvd-2026-30454 https://cve.radiocsirt.org/vuln/fkie_cve-2021-39168 <p>OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team&#39;s control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.</p> <p>OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team&#39;s control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-39168 https://cve.radiocsirt.org/vuln/ghsa-vrw4-w73r-6mm8 <p><strong>Affected:</strong> npm: @openzeppelin/contracts-upgradeable</p> <p>### Impact</p> <p>A vulnerability in `TimelockController` allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to &#34;open&#34; allow anyone to use the executor role, thus leaving the timelock at risk of being taken over by an attacker.</p> <p>### Patches</p> <p>A fix is included in the following releases of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`: - 4.3.1 - 3.4.2 - 3.4.2-solc-0.7</p> <p>Deployed instances of `TimelockController` should be replaced with a fixed version by migrating all assets, ownership, and roles.</p> <p>### Workarounds</p> <p>Revoke the executor role from accounts not strictly under the team&#39;s control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.</p> <p>### References</p> <p>[Post-mortem](https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-postmortem/14958).</p> <p>### Credits</p> <p>The issue was identified by an anonymous white hat hacker through [Immunefi](https://immunefi.com/).</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.</p> <p><strong>Affected:</strong> npm: @openzeppelin/contracts-upgradeable</p> <p>### Impact</p> <p>A vulnerability in `TimelockController` allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to &#34;open&#34; allow anyone to use the executor role, thus leaving the timelock at risk of being taken over by an attacker.</p> <p>### Patches</p> <p>A fix is included in the following releases of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`: - 4.3.1 - 3.4.2 - 3.4.2-solc-0.7</p> <p>Deployed instances of `TimelockController` should be replaced with a fixed version by migrating all assets, ownership, and roles.</p> <p>### Workarounds</p> <p>Revoke the executor role from accounts not strictly under the team&#39;s control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.</p> <p>### References</p> <p>[Post-mortem](https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-postmortem/14958).</p> <p>### Credits</p> <p>The issue was identified by an anonymous white hat hacker through [Immunefi](https://immunefi.com/).</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.</p> https://cve.radiocsirt.org/vuln/ghsa-vrw4-w73r-6mm8 https://cve.radiocsirt.org/vuln/gsd-2021-39168 gsd-2021-39168 https://cve.radiocsirt.org/vuln/gsd-2021-39168