What is GHSA-7m37-cx35-qgmr?

GHSA-7m37-cx35-qgmr is a security advisory published by GitHub Security Advisories with High severity. Uniswap Universal Router Incorrect Authorization vulnerability

Which CVE IDs does GHSA-7m37-cx35-qgmr cover?

GHSA-7m37-cx35-qgmr covers the following CVE IDs: CVE-2022-48216. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7m37-cx35-qgmr?

GHSA-7m37-cx35-qgmr has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-7m37-cx35-qgmr?

GHSA-7m37-cx35-qgmr affects 1 product, including: npm/@uniswap/universal-router:\u003c 1.1.0.

GHSA-7m37-cx35-qgmrHighCVSS 7.5

Uniswap Universal Router Incorrect Authorization vulnerability

Vendor

GitHub Security Advisories

Published

January 4, 2023

Last Modified

April 10, 2025

🔗 CVE IDs covered (1)

CVE-2022-48216 →

📋 Description

Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds.

🎯 Affected products1

npm/@uniswap/universal-router:< 1.1.0

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2022-48216
https://github.com/Uniswap/universal-router/pull/189
https://github.com/Uniswap/universal-router/commit/d82c6685ef566d9b280651c99f4b93a8454c08a8
https://github.com/Uniswap/universal-router/compare/v1.0.1...v1.1.0
https://media.dedaub.com/uniswap-bug-bounty-1625d8ff04ae
https://twitter.com/dedaub/status/1610058814094450694
https://github.com/advisories/GHSA-7m37-cx35-qgmr