Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-39168

30
FAUCET Score

CVE-2021-39168 is a critical privilege escalation vulnerability affecting OpenZeppelin's TimelockController in smart contract development. An actor with the executor role could exploit this to gain elevated privileges, impacting the confidentiality, integrity, and availability of affected systems. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required. While no active exploitation, public exploit code, or significant community discussion has been observed, immediate mitigation by revoking non-proposer executor roles is strongly recommended.

Impacted Technologies

VendorProductVersion(s)CPE
>= 3.3.0, < 3.4.2CPE matchmatch criteria
cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*
>= 4.0.0, < 4.3.1CPE matchmatch criteria
cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

10.0CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
6.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.59%
Probability of exploitation in next 30 days
EPSS Percentile
73.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0159 is in the 60th percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: @openzeppelin/contracts-upgradeableFixed in: 4.3.1
npmpatch availablevia ghsa
Product: @openzeppelin/contracts-upgradeableFixed in: 3.4.2

Vendor Advisories (1)

npmGHSA-vrw4-w73r-6mm8critical

TimelockController vulnerability in OpenZeppelin Contracts

Aug 30, 2021

References

github.com / OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md
PatchRelease NotesThird Party Advisory
github.com / OpenZeppelin/openzeppelin-contracts/commit/cec4f2ef57495d8b1742d62846da212515d99dd5
PatchThird Party Advisory
github.com / OpenZeppelin/openzeppelin-contracts-upgradeable/security/advisories/GHSA-vrw4-w73r-6mm8
Third Party Advisory