Executive brief
OpenZeppelin Contracts Wizard is a tool that generates smart contract source code for Solidity, Cairo, Stellar, and Stylus blockchains. When untrusted input is supplied to the security contact or license fields, newline characters can break out of code comments and inject arbitrary contract code, compromising the integrity of generated contracts used in automated pipelines or agent-driven integrations.
Technical details
The vulnerability is a code injection flaw (CWE-94, CWE-116) in the Contracts Wizard generators. The setInfo method printed info.securityContact and info.license fields verbatim into single-line comments of generated source code without sanitizing newline characters (\n or \r\n). A newline in either field terminates the comment, allowing subsequent text to be emitted as executable source code rather than remaining in the comment, enabling injection of arbitrary declarations into the generated contract. The attack vector is local and requires no privileges, though user interaction is required. The vulnerability only poses a risk when these fields are populated from untrusted sources (e.g., an MCP agent processing external content); self-service use where the user supplies and consumes their own output is not impacted. The fix rejects line terminators in setInfo to prevent comment breakout.
Affected products
- OpenZeppelin Contracts Wizard <=0.10.10
- OpenZeppelin Wizard Cairo <=3.0.0
- OpenZeppelin Wizard Stellar <=0.6.1
- OpenZeppelin Wizard Stylus <=0.3.0
Timeline
- 2026-06-19: disclosed: Advisory published
- 2026-06-19: patched: @openzeppelin/wizard patched to 0.10.11; @openzeppelin/wizard-cairo to 3.0.1; @openzeppelin/wizard-stellar to 0.6.2; @openzeppelin/wizard-stylus to 0.3.1