@openzeppelin/contracts-upgradeable (npm)
Advisories
24
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.4.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install @openzeppelin/contracts-upgradeable@5.4.0yarn
yarn add @openzeppelin/contracts-upgradeable@5.4.0pnpm
pnpm add @openzeppelin/contracts-upgradeable@5.4.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-9rcw-c2f9-2j55 OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers |
Medium EPSS 0.40% |
>= 5.2.0, < 5.4.0 | 5.4.0 |
| GHSA-9vx6-7xxf-x967 OpenZeppelin Contracts base64 encoding may read from potentially dirty memory |
High EPSS 0.76% |
>= 4.5.0, < 4.9.6 | 4.9.6 |
| GHSA-9vx6-7xxf-x967 OpenZeppelin Contracts base64 encoding may read from potentially dirty memory |
High EPSS 0.76% |
>= 5.0.0-rc.0, < 5.0.2 | 5.0.2 |
| GHSA-699g-q6qh-q4v8 OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4 |
High EPSS 0.54% |
>= 4.9.4, < 4.9.5 | 4.9.5 |
| GHSA-g4vp-m682-qqmp OpenZeppelin Contracts vulnerable to Improper Escaping of Output |
Medium EPSS 0.74% |
>= 4.0.0, < 4.9.3 | 4.9.3 |
| GHSA-wprv-93r4-jj2p OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees |
Medium EPSS 0.37% |
>= 4.7.0, < 4.9.2 | 4.9.2 |
| GHSA-5h3x-9wvq-w4m2 OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning |
Medium EPSS 0.60% |
>= 4.3.0, < 4.9.1 | 4.9.1 |
| GHSA-mx2q-35m2-x2rh OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated |
Medium EPSS 0.81% |
>= 3.2.0, < 4.8.3 | 4.8.3 |
| GHSA-93hq-5wgc-jc82 GovernorCompatibilityBravo may trim proposal calldata |
High EPSS 0.58% |
>= 4.3.0, < 4.8.3 | 4.8.3 |
| GHSA-878m-3g6q-594q OpenZeppelin Contracts contains Incorrect Calculation |
Medium EPSS 0.71% |
>= 4.8.0, < 4.8.2 | 4.8.2 |
| GHSA-4h98-2769-gh6h OpenZeppelin Contracts vulnerable to ECDSA signature malleability |
High EPSS 0.45% |
>= 4.1.0, < 4.7.3 | 4.7.3 |
| GHSA-xrc4-737v-9q75 OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals |
High EPSS 0.79% |
>= 4.3.0, < 4.7.2 | 4.7.2 |
| GHSA-9j3m-g383-29qr OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls |
Medium EPSS 0.60% |
>= 4.6.0, < 4.7.2 | 4.7.2 |
| GHSA-7grf-83vw-6f5x OpenZeppelin Contracts ERC165Checker unbounded gas consumption |
Medium EPSS 0.80% |
>= 3.2.0, < 4.7.2 | 4.7.2 |
| GHSA-4g63-c64m-25w9 OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers |
High EPSS 0.50% |
>= 4.1.0, < 4.7.1 | 4.7.1 |
| GHSA-qh9x-gcfh-pcrw OpenZeppelin Contracts's ERC165Checker may revert instead of returning false |
High EPSS 0.79% |
>= 4.0.0, < 4.7.1 | 4.7.1 |
| GHSA-7j52-6fjp-58gr Inconsistent storage layout for ERC2771ContextUpgradeable |
Low | >= 4.0.0, < 4.3.0 | 4.3.0 |
| GHSA-m6w8-fq7v-ph4m GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior |
Medium | >= 4.3.0, < 4.4.2 | 4.4.2 |
| GHSA-9c22-pwxw-p6hx Improper Initialization in OpenZeppelin |
Medium EPSS 1.22% |
>= 3.2.0, < 4.4.1 | 4.4.1 |
| GHSA-wmpv-c2jp-j2xg ERC1155Supply vulnerability in OpenZeppelin Contracts |
Low | >= 4.2.0, < 4.3.3 | 4.3.3 |
| GHSA-5vp3-v4hc-gx76 UUPSUpgradeable vulnerability in @openzeppelin/contracts |
Critical EPSS 1.49% |
>= 4.1.0, < 4.3.2 | 4.3.2 |
| GHSA-q4h9-46xg-m3x9 UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable |
Critical | >= 4.1.0, < 4.3.2 | 4.3.2 |
| GHSA-vrw4-w73r-6mm8 TimelockController vulnerability in OpenZeppelin Contracts |
Critical EPSS 1.59% |
>= 4.0.0, < 4.3.1 | 4.3.1 |
| GHSA-vrw4-w73r-6mm8 TimelockController vulnerability in OpenZeppelin Contracts |
Critical EPSS 1.59% |
>= 3.3.0, < 3.4.2 | 3.4.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor