OpenZeppelin Vulnerabilities and Affected Products
Vulnerabilities associated with contracts-wizard.
Products
Clear product- openzeppelin-contracts18 vulnerabilities
- cairo-contracts3 vulnerabilities
- contracts-wizard1 vulnerability
- openzeppelin-confidential-contracts1 vulnerability
- openzeppelin-contracts-upgradeable1 vulnerability
- openzeppelin_contracts1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-48054HIGH | OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uriOpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721) and `opts.uri` (ERC1155) directly into TypeScript string literals at `zip-hardhat.ts:48` and `:50` without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as `https[:]//wizard[.]openzeppelin[.]co… CWE-94Aug 6, 2026 | CVSS8.8v3.1 | EPSS0.455% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |