CVE-2022-31198: 
JavaScript vulnerability analysis and mitigation

The vulnerability (CVE-2022-31198) affects OpenZeppelin's contracts-upgradeable package versions >=4.3.0 and <4.7.2. The issue specifically impacts instances of Governor that use the GovernorVotesQuorumFraction module, which determines quorum requirements as a percentage of the voting token's total supply (OpenZeppelin Advisory).

The vulnerability exists in the GovernorVotesQuorumFraction module's quorum management mechanism. When a proposal is passed to lower the quorum requirements, previously defeated proposals that failed due to lack of quorum could become executable if the number of votes they received meets the new lowered quorum threshold (OpenZeppelin Advisory).

The impact of this vulnerability allows past defeated proposals to potentially become executable when a proposal to update to lower quorum votes is passed. Analysis of instances on-chain identified one proposal that met this condition (OpenZeppelin Advisory).

The vulnerability has been patched in version 4.7.2 of the affected packages. As a workaround, users should avoid lowering quorum requirements if any past proposals were defeated for lack of quorum (OpenZeppelin Advisory).