CVE-2026-48054 OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
Attackers can inject malicious code into generated test files via unsanitized inputs, leading to remote code execution on developers' machines when tests are run.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-48054?
CVE-2026-48054 is a high-severity code injection vulnerability in OpenZeppelin contracts-wizard, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721) and `opts.uri` (ERC1155) directly into TypeScript string literals at `zip-hardhat.ts:48` and `:50` without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as `https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=");require("child_process").execSync("...");("` and shares it with a developer. When the victim downloads the resulting zip archive and runs `npx hardhat test`, the injected Node.js code executes with the developer's local OS privileges. Version 0.10.9 fixes the issue.
Weakness: CWE-94
Which versions are affected by CVE-2026-48054?
2 open source packages ship an affected version, including @openzeppelin/wizard.
| Package | Affected | Fixed in |
|---|---|---|
@openzeppelin/wizard npm | All versions | 0.10.9 |
@openzeppelin/wizard npm | All versions | 0.10.9 |
How do I fix CVE-2026-48054?
Upgrade @openzeppelin/wizard to 0.10.9 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-48054 being exploited?
There is no known exploitation of CVE-2026-48054 in the wild and no public exploit code.
Sources
Also known as GHSA-4x76-22x2-rx8v.