{"id":"GHSA-88g8-f5mf-f5rj","summary":"Improper Initialization in OpenZeppelin","details":"In OpenZeppelin \u003c=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible, breaking the expectation that there is a single execution.","aliases":["CVE-2021-46320","CVE-2022-39384","GHSA-9c22-pwxw-p6hx"],"modified":"2026-07-16T03:56:17.546633851Z","published":"2022-02-05T00:00:31Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2022-02-11T16:20:03Z","nvd_published_at":"2022-02-04T12:15:00Z","cwe_ids":["CWE-665"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9c22-pwxw-p6hx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46320"},{"type":"WEB","url":"https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3006"},{"type":"PACKAGE","url":"https://github.com/OpenZeppelin/openzeppelin-contracts"},{"type":"WEB","url":"https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.4.1"}],"affected":[{"package":{"name":"@openzeppelin/contracts","ecosystem":"npm","purl":"pkg:npm/%40openzeppelin/contracts"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.4.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-88g8-f5mf-f5rj/GHSA-88g8-f5mf-f5rj.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}