Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-39167

30
FAUCET Score

CVE-2021-39167 is a critical privilege escalation vulnerability affecting OpenZeppelin's TimelockController in smart contract development libraries. An actor with the executor role can exploit this flaw to escalate privileges, potentially leading to full compromise of the smart contract. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with no user interaction, resulting in high impacts to confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, a workaround involves revoking executor roles from untrusted accounts, ensuring at least one proposer and executor remains.

Impacted Technologies

VendorProductVersion(s)CPE
>= 3.3.0, < 3.4.2CPE matchmatch criteria
cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*
>= 4.0.0, < 4.3.1CPE matchmatch criteria
cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

10.0CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
6.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.59%
Probability of exploitation in next 30 days
EPSS Percentile
73.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0159 is in the 60th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: @openzeppelin/contractsFixed in: 4.3.1
npmpatch availablevia ghsa
Product: @openzeppelin/contractsFixed in: 3.4.2

Vendor Advisories (1)

npmGHSA-fg47-3c2x-m2wrcritical

TimelockController vulnerability in OpenZeppelin Contracts

Aug 30, 2021

References

github.com / OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md
PatchRelease NotesThird Party Advisory
github.com / OpenZeppelin/openzeppelin-contracts/commit/cec4f2ef57495d8b1742d62846da212515d99dd5
PatchThird Party Advisory
github.com / OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-fg47-3c2x-m2wr
Third Party Advisory