{"action":"Upgrade @openzeppelin/contracts-upgradeable to 4.9.2 or later.","affected":[{"fixed":"4.9.2","introduced":"4.7.0"}],"component":"@openzeppelin/contracts-upgradeable","cve_ids":["CVE-2023-34459"],"ecosystem":"npm","epss":0.00371,"exploited":false,"fixed_versions":["4.9.2"],"ghsa_id":"GHSA-wprv-93r4-jj2p","id":"tcs_01M5KGFNFP07ZR0B7HREWS5X7E","modified_at":"2026-09-10T03:50:02.441943191Z","published_at":"2023-06-19T19:46:37Z","references":["https://osv.dev/vulnerability/GHSA-wprv-93r4-jj2p","https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-wprv-93r4-jj2p","https://nvd.nist.gov/vuln/detail/CVE-2023-34459","https://github.com/OpenZeppelin/openzeppelin-contracts/commit/4d2383e17186be3e8ccf5a442e9686ecc7de1c55","https://github.com/OpenZeppelin/openzeppelin-contracts","https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.2"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-wprv-93r4-jj2p#npm/@openzeppelin/contracts-upgradeable","url":"https://osv.dev/vulnerability/GHSA-wprv-93r4-jj2p"}],"summary":"OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees"}