CVE-2026-48054

HighCVSS 8.8

Published: 06/08/2026(UTC)Updated: 14/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

38th percentile - higher than 38% of all known CVEs

Summary

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (test/test.ts) by interpolating user-supplied opts.name (ERC20/ERC721) and opts.uri (ERC1155) directly into TypeScript string literals at zip-hardhat.ts:48 and :50 without any JavaScript string escaping. No authentication is required: an attacker crafts a URL and shares it with a developer. When the victim downloads the resulting zip archive and runs npx hardhat test, the injected Node.js code executes with the developer's local OS privileges.

Risk Assessment

A developer running the tests may unknowingly execute arbitrary attacker code on their machine, leading to full workstation compromise.

Recommendation

Update OpenZeppelin Contracts Wizard to version 0.10.9, which fixes the issue.

Other vulnerabilities in OpenZeppelin Contracts Wizard

CVE-2026-57583Low
OpenZeppelin Contracts Wizard prior to @openzeppelin/wizard 0.10.11, wizard-cairo 3.0.1, wizard-stellar 0.6.2, and wizard-stylus 0.3.1 prints info.securityContact and info.license verbatim into single-line comments in generated source. A line terminator ends the comment, causing following input to be emitted as source declarations.

Original NVD description (English source)

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721) and `opts.uri` (ERC1155) directly into TypeScript string literals at `zip-hardhat.ts:48` and `:50` without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as `https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=");require("child_process").execSync("...");("` and shares it with a developer. When the victim downloads the resulting zip archive and runs `npx hardhat test`, the injected Node.js code executes with the developer's local OS privileges. Version 0.10.9 fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS