oz-known-issues

OpenZeppelin Known Vulnerabilities Find the version that the project you currently develop or audit uses and quickly check which are the known smart contract security vulnerabilities that may affect your code. Source: https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories...

@raycashxyz/confidential-primitives (>=0.1.0, <=0.1.1), @zentity/contracts (>=0.6.0, <=0.7.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (>=0.3.0, <=0.3.1)

@openzeppelin/confidential-contracts NPM version =0.3.0, =0.1.0, =0.6.0, =0.1.0, =0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-29H2-JR22-FRMH...

Improper Authorization

Overview @openzeppelin/confidential-contracts is a Smart Contract library for use with confidential coprocessors Affected versions of this package are vulnerable to Improper Authorization via the release and vestedAmount functions in VestingWalletConfidential.sol, which consume encrypted FHE...

OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet

Impact Two locations consume an encrypted handle returned by an untrusted external party and use it without verifying that the party is ACL-authorized on it. VestingWalletConfidential Malicious users can call release with a malicious token. This token could return an alternative handle on...

@raycashxyz/confidential-primitives (>=0.1.0, <=0.1.1), @zentity/contracts (>=0.6.0, <=0.7.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (>=0.3.0, <=0.3.1)

@openzeppelin/confidential-contracts NPM version =0.3.0, =0.1.0, =0.6.0, =0.1.0, =0.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-OPENZEPPELINCONFIDENTIALCONTRACTS-20158601...

GHSA-29H2-JR22-FRMH OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet

Impact Two locations consume an encrypted handle returned by an untrusted external party and use it without verifying that the party is ACL-authorized on it. VestingWalletConfidential Malicious users can call release with a malicious token. This token could return an alternative handle on...

@raycashxyz/confidential-primitives (>=0.1.0, <=0.1.1), @zentity/contracts (>=0.6.0, <=0.7.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (>=0.3.0, <=0.3.1)

@openzeppelin/confidential-contracts NPM version =0.3.0, =0.1.0, =0.6.0, =0.1.0, =0.5.0 Source cves: unknown CVE Source advisory: GHSA-29H2-JR22-FRMH...

@gudman/charter-conformance (0.1.0), @gudman/charter-core (0.1.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (0.5.1)

@openzeppelin/confidential-contracts NPM version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/confidential-contracts and may be impacted: - @gudman/charter-conformance 0.1.0 - @gudman/charter-core 0.1.0 -...

@gudman/charter-conformance (0.1.0), @gudman/charter-core (0.1.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (0.5.1)

@openzeppelin/confidential-contracts NPM version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/confidential-contracts and may be impacted: - @gudman/charter-conformance 0.1.0 - @gudman/charter-core 0.1.0 -...

@gudman/charter-conformance (0.1.0), @gudman/charter-core (0.1.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (0.5.1)

@openzeppelin/confidential-contracts NPM version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/confidential-contracts and may be impacted: - @gudman/charter-conformance 0.1.0 - @gudman/charter-core 0.1.0 -...

CVE-2026-57583

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...

@m3s/smart-contract (>=1.4.1, <=2.3.8), @openzeppelin/contracts-cli (0.1.0) +2 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard-stellar (>=0.1.1, <=0.5.0)

@openzeppelin/wizard-stellar NPM version =0.1.1, =1.4.1, =0.0.5, =0.0.1, =0.0.4 Source cves: CVE-2026-57583 Source advisory: MEND:CVE-2026-57583...

CVE-2026-57583 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...

CVE-2026-57583

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...

CVE-2026-57583 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...

CVE-2026-57583 OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-57583 Source advisory: MEND:CVE-2026-57583...

@m3s/smart-contract (>=1.4.1, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.4.5) +1 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard-stylus (0.2.0)

@openzeppelin/wizard-stylus NPM version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/wizard-stylus and may be impacted: - @m3s/smart-contract =1.4.1, =0.0.5, =0.0.1, =0.0.4 Source cves: CVE-2026-57583 Source advisory:...

CVE-2026-57583

OpenZeppelin Contracts Wizard (npm packages @openzeppelin/wizard, @openzeppelin/wizard-cairo, @openzeppelin/wizard-stellar, @openzeppelin/wizard-stylus) is affected by an improper encoding/escaping vulnerability in the setInfo code path. The fields info.securityContact and info.license are printe...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.4.6) +2 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard-cairo (>=0.1.0, <=2.1.0)

@openzeppelin/wizard-cairo NPM version =0.1.0, =1.1.5, =0.0.5, =0.0.1, =0.1.4, =0.1.6 Source cves: CVE-2026-57583 Source advisory: MEND:CVE-2026-57583...