CVE-2026-57583: OpenZeppelin Contracts Wizard code injection via line terminators

CVE-2026-57583 · Severity: low · CVSS 3.3 · Published 2026-09-14

OpenZeppelin Contracts Wizard is a tool that generates smart contract source code for Solidity, Cairo, Stellar, and Stylus blockchains. When untrusted input is supplied to the security contact or license fields, newline characters can break out of code comments and inject arbitrary contract code, compromising the integrity of generated contracts used in automated pipelines or agent-driven integrations.

Vendors: npm, OpenZeppelin.

Quick answers

Is CVE-2026-57583 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57583 being exploited in the wild.
How severe is CVE-2026-57583?
Low severity, with a CVSS score of 3.3, published 14 September 2026.
Which products and versions are affected?
@openzeppelin/wizard (npm) SEMVER:introduced=0,fixed=0.10.11; @openzeppelin/wizard-cairo (npm) SEMVER:introduced=0,fixed=3.0.1; @openzeppelin/wizard-stellar (npm) SEMVER:introduced=0,fixed=0.6.2; @openzeppelin/wizard-stylus (npm) SEMVER:introduced=0,fixed=0.3.1; and 4 more.
Is there a fix for CVE-2026-57583?
Yes. @openzeppelin/wizard (npm): upgrade to 0.10.11 or later; @openzeppelin/wizard-cairo (npm): upgrade to 3.0.1 or later; @openzeppelin/wizard-stellar (npm): upgrade to 0.6.2 or later; @openzeppelin/wizard-stylus (npm): upgrade to 0.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57583 attacked?
It is attacked with local access.
Am I affected by CVE-2026-57583?
Check whether you run @openzeppelin/wizard (npm), @openzeppelin/wizard-cairo (npm), @openzeppelin/wizard-stellar (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @openzeppelin/wizard (npm): upgrade to 0.10.11 or later
    npm install @openzeppelin/wizard@0.10.11
  • @openzeppelin/wizard-cairo (npm): upgrade to 3.0.1 or later
    npm install @openzeppelin/wizard-cairo@3.0.1
  • @openzeppelin/wizard-stellar (npm): upgrade to 0.6.2 or later
    npm install @openzeppelin/wizard-stellar@0.6.2
  • @openzeppelin/wizard-stylus (npm): upgrade to 0.3.1 or later
    npm install @openzeppelin/wizard-stylus@0.3.1

Technical details

The vulnerability is a code injection flaw (CWE-94, CWE-116) in the Contracts Wizard generators. The setInfo method printed info.securityContact and info.license fields verbatim into single-line comments of generated source code without sanitizing newline characters (\n or \r\n). A newline in either field terminates the comment, allowing subsequent text to be emitted as executable source code rather than remaining in the comment, enabling injection of arbitrary declarations into the generated contract. The attack vector is local and requires no privileges, though user interaction is required. The vulnerability only poses a risk when these fields are populated from untrusted sources (e.g., an MCP agent processing external content); self-service use where the user supplies and consumes their own output is not impacted. The fix rejects line terminators in setInfo to prevent comment breakout.

Affected products

  • OpenZeppelin Contracts Wizard <=0.10.10
  • OpenZeppelin Wizard Cairo <=3.0.0
  • OpenZeppelin Wizard Stellar <=0.6.1
  • OpenZeppelin Wizard Stylus <=0.3.0

Identifiers

  • CVE-2026-57583
  • GHSA-9wxg-vf3r-56hc

Timeline

  • 2026-06-19: disclosed: Advisory published
  • 2026-06-19: patched: @openzeppelin/wizard patched to 0.10.11; @openzeppelin/wizard-cairo to 3.0.1; @openzeppelin/wizard-stellar to 0.6.2; @openzeppelin/wizard-stylus to 0.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.