{"id":"CVE-2026-48054","title":"OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts","summary":"OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `op…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-94"],"vendor":"OpenZeppelin","product":"contracts-wizard","affected":["contracts-wizard < 0.10.9"],"patched":["@openzeppelin/wizard 0.10.9"],"published":"2026-08-06","updated":"2026-09-14","sourceUpdated":"2026-09-14T18:17:48.623","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48054","references":[{"url":"https://github.com/OpenZeppelin/contracts-wizard/commit/ec12c44f8d9e0491eba31037f95b36e98ec58b5f","label":"security-advisories@github.com"},{"url":"https://github.com/OpenZeppelin/contracts-wizard/releases/tag/%40openzeppelin%2Fwizard%400.10.9","label":"security-advisories@github.com"},{"url":"https://github.com/OpenZeppelin/contracts-wizard/security/advisories/GHSA-4x76-22x2-rx8v","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-4x76-22x2-rx8v"}],"tags":["nvd","cve.org","ghsa","npm"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-08-07T14:52:56.794740Z"},"epss":0.00449,"epssPercentile":0.38396,"aliases":["GHSA-4x76-22x2-rx8v"],"ecosystem":"npm","ingestedAt":"2026-07-07T15:41:59.321Z","slug":"CVE-2026-48054","body":"## Overview\n\nOpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721) and `opts.uri` (ERC1155) directly into TypeScript string literals at `zip-hardhat.ts:48` and `:50` without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as `https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=\");require(\"child_process\").execSync(\"...\");(\"` and shares it with a developer. When the victim downloads the resulting zip archive and runs `npx hardhat test`, the injected Node.js code executes with the developer's local OS privileges. Version 0.10.9 fixes the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-48054)\n\nAffected packages:\n\n- `@openzeppelin/wizard <= 0.10.8`\n\nPatched in:\n\n- `@openzeppelin/wizard 0.10.9`\n\nSource: https://github.com/advisories/GHSA-4x76-22x2-rx8v","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}