{"action":"Upgrade @openzeppelin/contracts-upgradeable to 4.9.6 or later.","affected":[{"fixed":"5.0.2","introduced":"5.0.0-rc.0"},{"fixed":"4.9.6","introduced":"4.5.0"}],"component":"@openzeppelin/contracts-upgradeable","cve_ids":["CVE-2024-27094"],"ecosystem":"npm","epss":0.00763,"exploited":false,"fixed_versions":["5.0.2","4.9.6"],"ghsa_id":"GHSA-9vx6-7xxf-x967","id":"tcs_01M5KFH2A154PABTYSPGJ4C7KK","modified_at":"2025-12-05T12:36:38.324850Z","published_at":"2024-02-29T20:09:53Z","references":["https://osv.dev/vulnerability/GHSA-9vx6-7xxf-x967","https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9vx6-7xxf-x967","https://nvd.nist.gov/vuln/detail/CVE-2024-27094","https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854","https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1","https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0774eec3134e132a3d7b2a6","https://github.com/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3a645e5813e51993c490399c","https://github.com/OpenZeppelin/openzeppelin-contracts"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-9vx6-7xxf-x967#npm/@openzeppelin/contracts-upgradeable","url":"https://osv.dev/vulnerability/GHSA-9vx6-7xxf-x967"}],"summary":"OpenZeppelin Contracts base64 encoding may read from potentially dirty memory"}