CVE-2026-57583 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
Attackers can inject malicious code into generated smart contracts via line terminators in metadata fields, requiring specific integration setups.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-57583?
CVE-2026-57583 is a low-severity code injection vulnerability in @openzeppelin contracts-wizard, published on 14 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.
Which versions are affected by CVE-2026-57583?
8 open source packages ship an affected version, including @openzeppelin/wizard, @openzeppelin/wizard-cairo and @openzeppelin/wizard-stellar.
| Package | Affected | Fixed in |
|---|---|---|
@openzeppelin/wizard npm | All versions | 0.10.11 |
@openzeppelin/wizard npm | All versions | 0.10.11 |
@openzeppelin/wizard-cairo npm | All versions | 3.0.1 |
@openzeppelin/wizard-cairo npm | All versions | 3.0.1 |
@openzeppelin/wizard-stellar npm | All versions | 0.6.2 |
@openzeppelin/wizard-stellar npm | All versions | 0.6.2 |
2 more packages
@openzeppelin/wizard-stylus npm | All versions | 0.3.1 |
@openzeppelin/wizard-stylus npm | All versions | 0.3.1 |
How do I fix CVE-2026-57583?
Upgrade @openzeppelin/wizard to 0.10.11 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-57583 being exploited?
There is no known exploitation of CVE-2026-57583 in the wild and no public exploit code.
Sources
Also known as GHSA-9wxg-vf3r-56hc.