Improper Encoding or Escaping of Output

Overview @openzeppelin/wizard is an A boilerplate generator to get started with OpenZeppelin Contracts Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the setInfo process. An attacker can inject arbitrary lines into generated source code by supplyin...

@m3s/smart-contract (>=1.4.1, <=2.3.8), @openzeppelin/contracts-cli (0.1.0) +2 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard-stellar (>=0.1.1, <=0.5.0)

@openzeppelin/wizard-stellar NPM version =0.1.1, =1.4.1, =0.0.5, =0.0.1, =0.0.4 Source cves: CVE-2026-57583 Source advisory: OSV:GHSA-9WXG-VF3R-56HC...

Improper Encoding or Escaping of Output

Overview @openzeppelin/wizard-stellar is an A boilerplate generator to get started with OpenZeppelin Stellar Soroban Contracts Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the setInfo process. An attacker can inject arbitrary lines into generated...

Improper Encoding or Escaping of Output

Overview @openzeppelin/wizard-cairo is an A boilerplate generator to get started with OpenZeppelin Contracts for Cairo Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the setInfo process. An attacker can inject arbitrary lines into generated source...

@m3s/smart-contract (>=1.4.1, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.4.5) +1 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard-stylus (0.2.0)

@openzeppelin/wizard-stylus NPM version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/wizard-stylus and may be impacted: - @m3s/smart-contract =1.4.1, =0.0.5, =0.0.1, =0.0.4 Source cves: CVE-2026-57583 Source advisory:...

@m3s/smart-contract (>=1.4.1, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.4.5) +1 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard-stylus (0.2.0)

@openzeppelin/wizard-stylus NPM version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/wizard-stylus and may be impacted: - @m3s/smart-contract =1.4.1, =0.0.5, =0.0.1, =0.0.4 Source cves: CVE-2026-57583 Source advisory:...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-57583 Source advisory: SNYK:JS-OPENZEPPELINWIZARD-17817911...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-57583 Source advisory: OSV:GHSA-9WXG-VF3R-56HC...

Improper Encoding or Escaping of Output

Overview @openzeppelin/wizard-stylus is an A boilerplate generator to get started with OpenZeppelin Contracts for Stylus Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the setInfo process. An attacker can inject arbitrary lines into generated sourc...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-48054 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-48054 Source advisory: OSV:GHSA-4X76-22X2-RX8V...

Arbitrary Code Injection

Overview @openzeppelin/wizard is an A boilerplate generator to get started with OpenZeppelin Contracts Affected versions of this package are vulnerable to Arbitrary Code Injection via unsanitized user input in the zipHardhat and zipFoundry functions. An attacker can execute arbitrary code by...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-48054 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-48054 Source advisory: SNYK:JS-OPENZEPPELINWIZARD-17756776...

GHSA-4X76-22X2-RX8V OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

Summary The OpenZeppelin Contracts Wizard generated Hardhat test/test.ts and Foundry test/.t.sol example test files that interpolated user-supplied strings opts.name, opts.uri into the test source without escaping. A crafted input could produce a generated test file in which the input string brok...

PT-2026-48690

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts Wizard versions prior to 0.10.9 Description OpenZeppelin Contracts Wizard is a web application used to interactively build contracts. The application generates Hardhat test/test.ts and Foundry test/.t.sol example test...

CVE-2023-49798

OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of Multicall.sol released in @openzeppelin/[email protected] and @openzeppelin/[email protected], all subcalls are...

CVE-2022-31153

OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts vanilla and ethereum flavors in the...

CVE-2022-35915

OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 supportsInterface query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. The issue has been fixed in...

CVE-2022-35916

OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, CrossChainEnabledArbitrumL2 or LibArbitrumL2, will classify direct interactions of externally owned accounts EOAs as cross chain calls, even though they are not...

CVE-2021-41264

OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of @openzeppelin/contracts and...

CVE-2022-31170

OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning false. ERC165Checker.supportsInterface is designed to always successfully return a boolean, and under no circumstance revert. However, an...