-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from ERC165Checker's assumption that target contracts properly implement EIP-165. The core issue was in supportsERC165InterfaceUnchecked which performed an unsafe abi.decode on potentially malformed return data. The GitHub PR #3552 specifically modifies this function to check return data length and interpret any non-zero value as 'true', avoiding strict boolean decoding. While supportsInterface is the public facing function, the actual vulnerability was in the unchecked low-level implementation it depends on.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @openzeppelin/contracts | npm | >= 4.0.0, < 4.7.1 | 4.7.1 |
| @openzeppelin/contracts-upgradeable | npm | >= 4.0.0, < 4.7.1 | 4.7.1 |
Ongoing coverage of React2Shell