openzeppelin wizard vulnerabilities

Latest openzeppelin wizard CVEs

Newest publication first

1. CVE-2026-57583 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

   Published 2026-09-14

   Low·CVSS 3.3 EPSS 0.19%

   OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1,...

2. CVE-2026-48054 OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

   Published 2026-08-06

   High·CVSS 8.8 EPSS 0.64%

   OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (test/test.ts) by interpolating user-supplied opts.name (ERC20/ERC721) and opts.uri (ERC1155)...

3. GHSA-9wxg-vf3r-56hc OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

   Published 2026-06-19

   Low·CVSS 3.3

   Summary The Contracts Wizard generators printed info.securityContact and info.license verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line terminators. A newline (\n or \r\n) in either field ends the comme...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.