Skip to content
OpenAdvisories

Package · npm

@openzeppelin/wizard

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 3.3
    CVE-2026-57583

    OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

    OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/…

    OpenZeppelin contracts-wizard wizard wizard-stellar npm
  • High 8.8
    CVE-2026-48054

    OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

    OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721…

    OpenZeppelin contracts-wizard @openzeppelin/wizard npm