CVE-2026-57583

LowCVSS 3.3

Published: 14/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

OpenZeppelin Contracts Wizard prior to @openzeppelin/wizard 0.10.11, wizard-cairo 3.0.1, wizard-stellar 0.6.2, and wizard-stylus 0.3.1 prints info.securityContact and info.license verbatim into single-line comments in generated source. A line terminator ends the comment, causing following input to be emitted as source declarations.

Risk Assessment

If an integration populates these fields from untrusted input, generated code may contain injected declarations, affecting generated-source integrity. Normal web, CLI, and API use does not cross that trust boundary.

Recommendation

Update packages to versions 0.10.11, 3.0.1, 0.6.2, or 0.3.1. Ensure securityContact and license fields are not populated from untrusted input in integrations.

Other vulnerabilities in OpenZeppelin Contracts Wizard

CVE-2026-48054High
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (test/test.ts) by interpolating user-supplied opts.name (ERC20/ERC721) and opts.uri (ERC1155) directly into TypeScript string literals at zip-hardhat.ts:48 and :50 without any JavaScript string escaping. No authentication is required: an attacker crafts a URL and shares it with a developer. When the victim downloads the resulting zip archive and runs npx hardhat test, the injected Node.js code executes with the developer's local OS privileges.

Original NVD description (English source)

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS