CVE-2026-57583
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.
Scoring
- Severity
- LOW
- CVSS base score
- 3.3
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- EPSS probability
- 0.13%
- CWE
- CWE-94, CWE-116
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- OpenZeppelin contracts-wizard
- @openzeppelin wizard
- @openzeppelin wizard-cairo
- @openzeppelin wizard-stellar
- @openzeppelin wizard-stylus
Weakness type
Related vulnerabilities
- CVE-2026-60004 — Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- CVE-2026-76605 — Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2
- CVE-2026-76604 — Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2
- CVE-2026-92937 — vm2 3.11.6 Remote Code Execution via Promise call/apply
- CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
- CVE-2026-62104 — WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability
- CVE-2026-53710 — MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
- CVE-2026-55565 — Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)