CVE-2026-48054

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (test/test.ts) by interpolating user-supplied opts.name (ERC20/ERC721) and opts.uri (ERC1155) directly into TypeScript string literals at zip-hardhat.ts:48 and :50 without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=");require("child_process").execSync("...");(" and shares it with a developer. When the victim downloads the resulting zip archive and runs npx hardhat test, the injected Node.js code executes with the developer's local OS privileges. Version 0.10.9 fixes the issue.

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (test/test.ts) by interpolating user-supplied opts.name (ERC20/ERC721) and opts.uri (ERC1155) directly into TypeScript string literals at zip-hardhat.ts:48 and :50 without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=");require("child_process").execSync("...");(" and shares it with a developer. When the victim downloads the resulting zip archive and runs npx hardhat test, the injected Node.js code executes with the developer's local OS privileges. Version 0.10.9 fixes the issue.

Summary

The OpenZeppelin Contracts Wizard generated Hardhat (test/test.ts) and Foundry (test/<Name>.t.sol) example test files that interpolated user-supplied strings (opts.name, opts.uri) into the test source without escaping. A crafted input could produce a generated test file in which the input string broke out of its surrounding literal and was parsed as code, executing when a developer ran npm test or forge test on the downloaded project.

Impact

• Users of the hosted Wizard at https://wizard.openzeppelin.com: no action required. The site has been redeployed with the fix.
• Users of @openzeppelin/wizard via the documented public API: not affected. The vulnerable functions (zipHardhat, zipFoundry) are not part of the package's documented public exports.
• Callers of zipHardhat / zipFoundry who forward externally-controlled strings into opts.name / opts.uri: upgrade to 0.10.9.

Patches

Fixed in @openzeppelin/[email protected].

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (test/test.ts) by interpolating user-supplied opts.name (ERC20/ERC721) and opts.uri (ERC1155) directly into TypeScript string literals at zip-hardhat.ts:48 and :50 without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=");require("child_process").execSync("...");(" and shares it with a developer. When the victim downloads the resulting zip archive and runs npx hardhat test, the injected Node.js code executes with the developer's local OS privileges. Version 0.10.9 fixes the issue.

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (test/test.ts) by interpolating user-supplied opts.name (ERC20/ERC721) and opts.uri (ERC1155) directly into TypeScript string literals at zip-hardhat.ts:48 and :50 without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=");require("child_process").execSync("...");(" and shares it with a developer. When the victim downloads the resulting zip archive and runs npx hardhat test, the injected Node.js code executes with the developer's local OS privileges. Version 0.10.9 fixes the issue.

Summary

The OpenZeppelin Contracts Wizard generated Hardhat (test/test.ts) and Foundry (test/<Name>.t.sol) example test files that interpolated user-supplied strings (opts.name, opts.uri) into the test source without escaping. A crafted input could produce a generated test file in which the input string broke out of its surrounding literal and was parsed as code, executing when a developer ran npm test or forge test on the downloaded project.

Impact

• Users of the hosted Wizard at https://wizard.openzeppelin.com: no action required. The site has been redeployed with the fix.
• Users of @openzeppelin/wizard via the documented public API: not affected. The vulnerable functions (zipHardhat, zipFoundry) are not part of the package's documented public exports.
• Callers of zipHardhat / zipFoundry who forward externally-controlled strings into opts.name / opts.uri: upgrade to 0.10.9.

Patches

Fixed in @openzeppelin/[email protected].