{"action":"Upgrade @openzeppelin/confidential-contracts to 0.3.2 or later.","affected":[{"fixed":"0.3.2","introduced":"0"},{"fixed":"0.4.2","introduced":"0.4.0-rc.0"},{"fixed":"0.5.2","introduced":"0.5.0-rc.0"}],"component":"@openzeppelin/confidential-contracts","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.3.2","0.4.2","0.5.2"],"ghsa_id":"GHSA-29h2-jr22-frmh","id":"tcs_01M5KESNMZ7XRSM4ATFGQ1SC26","modified_at":"2026-09-25T19:45:09.704948941Z","published_at":"2026-09-25T19:31:08Z","references":["https://osv.dev/vulnerability/GHSA-29h2-jr22-frmh","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/security/advisories/GHSA-29h2-jr22-frmh","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/pull/423","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/pull/428","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/pull/431","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/commit/93e75ceed2b9648f53f9d133f431064353456805","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/commit/ee47edf189ab681cebdad18bfb53dee541987be2","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/commit/fe0863af2c9dce7614acce98720a913bf6a767a5","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/releases/tag/v0.3.2","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/releases/tag/v0.4.2","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/releases/tag/v0.5.2"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-29h2-jr22-frmh","url":"https://osv.dev/vulnerability/GHSA-29h2-jr22-frmh"}],"summary":"OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet"}