Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
OpenZeppelin Contracts and Contracts-Upgradeable from 3.2.0 before 4.4.1 are affected. An initializer function that runs separately from contract creation, such as in minimal proxies, can be re-entered if it makes an untrusted non-view external call, which can allow it to execute a second time. The source notes that upgradeable proxies are usually initialized during creation, where this is not feasible, so impact is believed to be minor. Upgrade both packages to 4.4.1 or later; until then, avoid untrusted external calls during initialization.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.6 | Medium | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.012, the 68th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.