{"action":"Upgrade ink_env to 4.2.1 or later.","affected":[{"fixed":"4.2.1","introduced":"4.0.0"}],"component":"ink_env","cve_ids":["CVE-2023-34449"],"ecosystem":"crates.io","epss":0.00967,"exploited":false,"fixed_versions":["4.2.1"],"ghsa_id":"GHSA-853p-5678-hv8f","id":"tcs_01M5KEVM14XY81TP1R661W32KX","modified_at":"2026-09-10T03:50:02.212000504Z","published_at":"2023-06-14T20:11:38Z","references":["https://osv.dev/vulnerability/GHSA-853p-5678-hv8f","https://github.com/paritytech/ink/security/advisories/GHSA-853p-5678-hv8f","https://nvd.nist.gov/vuln/detail/CVE-2023-34449","https://github.com/paritytech/ink/pull/1450","https://github.com/paritytech/ink/commit/f1407ee9f87e5f64d467a22d26ee88f61db7f3db","https://docs.rs/ink_env/4.2.0/ink_env/call/struct.CallBuilder.html#method.delegate","https://docs.rs/ink_env/4.2.0/ink_env/fn.invoke_contract_delegate.html","https://github.com/paritytech/ink"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-853p-5678-hv8f#crates.io/ink_env","url":"https://osv.dev/vulnerability/GHSA-853p-5678-hv8f"}],"summary":"ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`"}