Openzeppelin vulnerabilities
25 CVEs and advisories name Openzeppelin as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-57583OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
- CVE-2026-73645OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.
- CVE-2026-48054OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
- CVE-2025-54070OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers
- CVE-2024-45304OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts
- CVE-2024-27094OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
- CVE-2023-49798Duplicated execution of subcalls in OpenZeppelin Contracts
- CVE-2023-40014OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender
- CVE-2023-34459OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
- CVE-2023-34234Governor proposal creation may be blocked by frontrunning in OpenZeppelin
- CVE-2023-30541TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts
- CVE-2023-30542GovernorCompatibilityBravo may trim proposal calldata
- CVE-2023-26488OpenZeppelin Contracts contains Incorrect Calculation
- CVE-2023-23940OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypass
- CVE-2022-39384OpenZeppelin Contracts initializer reentrancy may lead to double initialization
- CVE-2022-35961ECDSA signature malleability in OpenZeppelin Contracts
- CVE-2022-35915Unbounded gas consumption in @openzeppelin/contracts
- CVE-2022-35916Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls
- CVE-2022-31198GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts
- CVE-2022-31170 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
- CVE-2022-31172OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers
- CVE-2022-31153OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli
- CVE-2021-41264UUPSUpgradeable vulnerability in OpenZeppelin Contracts
- CVE-2021-39167TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-39168TimelockController vulnerability in OpenZeppelin Contracts