Executive brief
OpenZeppelin Contracts Wizard is a tool used to generate smart contract code for various blockchain platforms. A vulnerability was found where certain input fields, such as security contact or license information, do not properly handle line breaks. This could allow an attacker to inject unauthorized code into a generated contract if the tool is integrated into a system that processes untrusted input, potentially compromising the integrity of the resulting smart contract.
Technical details
The vulnerability is a code injection flaw (CWE-94) caused by improper neutralization of line terminators (CWE-116) in the 'info.securityContact' and 'info.license' fields. These fields are printed verbatim into single-line comments in the generated Solidity, Cairo, Stellar, or Stylus source code. An attacker can use newline characters (\n or \r\n) to terminate the comment and inject arbitrary declarations into the contract source. This is primarily a risk for integrations (like AI agents or APIs) that populate these fields from untrusted third-party input. The issue is fixed in @openzeppelin/wizard v0.10.11 and related packages by rejecting line terminators in the 'setInfo' function.
Affected products
- OpenZeppelin @openzeppelin/wizard <= 0.10.10
- OpenZeppelin @openzeppelin/wizard-cairo <= 3.0.0
- OpenZeppelin @openzeppelin/wizard-stellar <= 0.6.1
- OpenZeppelin @openzeppelin/wizard-stylus <= 0.3.0
Timeline
- 2026-06-18: disclosed
- 2026-06-19: advisory