{"action":"Upgrade @openzeppelin/contracts to 3.4.2 or later.","affected":[{"fixed":"4.3.1","introduced":"4.0.0"},{"fixed":"3.4.2","introduced":"3.3.0"}],"component":"@openzeppelin/contracts","cve_ids":["CVE-2021-39167"],"ecosystem":"npm","epss":0.0159,"exploited":false,"fixed_versions":["4.3.1","3.4.2"],"ghsa_id":"GHSA-fg47-3c2x-m2wr","id":"tcs_01M5KFNE40YNVBYQNH38K2FNHZ","modified_at":"2026-07-08T06:29:37.864167374Z","published_at":"2021-08-30T16:12:38Z","references":["https://osv.dev/vulnerability/GHSA-fg47-3c2x-m2wr","https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-fg47-3c2x-m2wr","https://nvd.nist.gov/vuln/detail/CVE-2021-39167","https://github.com/OpenZeppelin/openzeppelin-contracts/commit/cec4f2ef57495d8b1742d62846da212515d99dd5","https://github.com/OpenZeppelin/openzeppelin-contracts","https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md#431"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-fg47-3c2x-m2wr","url":"https://osv.dev/vulnerability/GHSA-fg47-3c2x-m2wr"}],"summary":"TimelockController vulnerability in OpenZeppelin Contracts"}