{"action":"Upgrade @openzeppelin/contracts-upgradeable to 3.4.2 or later.","affected":[{"fixed":"4.3.1","introduced":"4.0.0"},{"fixed":"3.4.2","introduced":"3.3.0"}],"component":"@openzeppelin/contracts-upgradeable","cve_ids":["CVE-2021-39168"],"ecosystem":"npm","epss":0.0159,"exploited":false,"fixed_versions":["4.3.1","3.4.2"],"ghsa_id":"GHSA-vrw4-w73r-6mm8","id":"tcs_01M5KGCXWM2K4VFZ6YCC97AZNV","modified_at":"2026-07-08T06:28:10.673020859Z","published_at":"2021-08-30T16:12:49Z","references":["https://osv.dev/vulnerability/GHSA-vrw4-w73r-6mm8","https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/security/advisories/GHSA-vrw4-w73r-6mm8","https://nvd.nist.gov/vuln/detail/CVE-2021-39168","https://github.com/OpenZeppelin/openzeppelin-contracts/commit/cec4f2ef57495d8b1742d62846da212515d99dd5","https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeabl","https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md#431"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-vrw4-w73r-6mm8","url":"https://osv.dev/vulnerability/GHSA-vrw4-w73r-6mm8"}],"summary":"TimelockController vulnerability in OpenZeppelin Contracts"}