openzeppelin contracts-wizard vulnerabilities

Latest openzeppelin contracts-wizard CVEs

Newest publication first

1. CVE-2026-57583 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

   Published 2026-09-14

   Low·CVSS 3.3 EPSS 0.19%

   OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1,...

2. CVE-2026-48054 OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

   Published 2026-08-06

   High·CVSS 8.8 EPSS 0.64%

   OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (test/test.ts) by interpolating user-supplied opts.name (ERC20/ERC721) and opts.uri (ERC1155)...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.