{"id":"CVE-2026-57583","aliases":["EUVD-2026-77702","GHSA-9wxg-vf3r-56hc"],"status":"published","title":"OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source","description":"OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00187,"percentile":0.08419,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-94"],"published":"2026-06-19T17:45:15Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"npm","package":"@openzeppelin/wizard","fixed_in":["0.10.11"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@openzeppelin/wizard-cairo","fixed_in":["3.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@openzeppelin/wizard-stellar","fixed_in":["0.6.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@openzeppelin/wizard-stylus","fixed_in":["0.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@openzeppelin/wizard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.10.10"},{"fixed":"0.10.11"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@openzeppelin/wizard-cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.0"},{"fixed":"3.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@openzeppelin/wizard-stellar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.6.1"},{"fixed":"0.6.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@openzeppelin/wizard-stylus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.0"},{"fixed":"0.3.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@openzeppelin/wizard","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.10.11"}]}]},{"source":"osv","ecosystem":"npm","package":"@openzeppelin/wizard-cairo","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@openzeppelin/wizard-stellar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@openzeppelin/wizard-stylus","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.1"}]}]}],"products":[{"vendor":"@openzeppelin","product":"wizard"},{"vendor":"@openzeppelin","product":"wizard-cairo"},{"vendor":"@openzeppelin","product":"wizard-stellar"},{"vendor":"@openzeppelin","product":"wizard-stylus"},{"vendor":"openzeppelin","product":"contracts-wizard"}],"references":[{"url":"https://github.com/OpenZeppelin/contracts-wizard/security/advisories/GHSA-9wxg-vf3r-56hc","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/OpenZeppelin/contracts-wizard/pull/818","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/OpenZeppelin/contracts-wizard/commit/6b18ecbd727a22d9f8c592e5d56caa2e977fb225","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-cairo@3.0.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-stellar@0.6.2","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-stylus@0.3.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard@0.10.11","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-9wxg-vf3r-56hc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57583.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57583","tags":["advisory"]},{"url":"https://github.com/OpenZeppelin/contracts-wizard","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-57583","title":"OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source","description":"OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.","status":"published","published":"2026-09-14T17:44:45.248Z","modified":"2026-09-14T19:06:58.101Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-94","CWE-116"],"updated_at":"2026-11-02T13:43:56.024247Z"}],"euvd":[{"id":"EUVD-2026-77702","description":"OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.","status":"published","published":"2026-09-14T17:44:45Z","modified":"2026-09-14T19:06:58Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T17:28:19.730872Z"}],"ghsa":[{"id":"GHSA-9wxg-vf3r-56hc","title":"OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source","description":"## Summary\n\nThe Contracts Wizard generators printed `info.securityContact` and `info.license` verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line terminators. A newline (`\\n` or `\\r\\n`) in either field ends the comment, so the text after it is emitted as source rather than remaining inside the comment — allowing arbitrary declarations to be injected into the generated contract.\n\n## Impact\n\nThis only matters when these fields are filled from input other than the user who will use the generated contract. Normal self-service use does not meet that condition:\n\n- **Web app, AI assistant, and CLI:** the user supplies these fields and uses their own output, so a line break only affects their own contract. (These fields are not URL-derived, so shared links cannot set them.)\n- **Self-hosted API:** same — the end user supplies the options and consumes the result.\n\nThe case that matters is an integration that fills these fields from untrusted input — for example, an MCP agent whose tool arguments are derived from content it processed. There, a newline in the value can add lines to output that otherwise looks like normal Wizard source. Impact is integrity-only; there is no execution on any Wizard service.\n\n## Patches\n\nFixed by rejecting line terminators in `setInfo` — the single code path all surfaces use — so the value can no longer break out of the comment. Upgrade to the patched versions. `@openzeppelin/wizard-confidential` and `@openzeppelin/wizard-uniswap-hooks` reuse this `setInfo` through their `@openzeppelin/wizard` dependency and receive the fix once that dependency is updated to a patched version.","status":"published","published":"2026-06-19T17:45:15Z","modified":"2026-06-19T17:45:17Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-94","CWE-116"],"updated_at":"2026-11-02T14:40:30.53004Z"}],"nvd":[{"id":"CVE-2026-57583","description":"OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.","status":"published","published":"2026-09-14T18:17:58.72Z","modified":"2026-09-30T19:57:08.043Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-94","CWE-116"],"updated_at":"2026-11-02T14:12:46.980627Z"}],"osv":[{"id":"CVE-2026-57583","title":"OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source","description":"OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.","status":"published","published":"2026-09-14T17:44:45.248Z","modified":"2026-10-28T02:31:12.334538668Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-116","CWE-94"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"GHSA-9wxg-vf3r-56hc","title":"OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source","description":"## Summary\n\nThe Contracts Wizard generators printed `info.securityContact` and `info.license` verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line terminators. A newline (`\\n` or `\\r\\n`) in either field ends the comment, so the text after it is emitted as source rather than remaining inside the comment — allowing arbitrary declarations to be injected into the generated contract.\n\n## Impact\n\nThis only matters when these fields are filled from input other than the user who will use the generated contract. Normal self-service use does not meet that condition:\n\n- **Web app, AI assistant, and CLI:** the user supplies these fields and uses their own output, so a line break only affects their own contract. (These fields are not URL-derived, so shared links cannot set them.)\n- **Self-hosted API:** same — the end user supplies the options and consumes the result.\n\nThe case that matters is an integration that fills these fields from untrusted input — for example, an MCP agent whose tool arguments are derived from content it processed. There, a newline in the value can add lines to output that otherwise looks like normal Wizard source. Impact is integrity-only; there is no execution on any Wizard service.\n\n## Patches\n\nFixed by rejecting line terminators in `setInfo` — the single code path all surfaces use — so the value can no longer break out of the comment. Upgrade to the patched versions. `@openzeppelin/wizard-confidential` and `@openzeppelin/wizard-uniswap-hooks` reuse this `setInfo` through their `@openzeppelin/wizard` dependency and receive the fix once that dependency is updated to a patched version.","status":"published","published":"2026-06-19T17:45:15Z","modified":"2026-09-15T03:56:01.702706709Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-116","CWE-94"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}