CVE-2026-48054

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts Wizard versions prior to 0.10.9

Description OpenZeppelin Contracts Wizard is a web application used to interactively build contracts. The application generates Hardhat (test/test.ts) and Foundry (test/<Name>.t.sol) example test files by interpolating user-supplied strings into the test source without proper JavaScript string escaping. Specifically, the opts.name variable (used for ERC20/ERC721) and the opts.uri variable (used for ERC1155) are interpolated directly into TypeScript string literals at zip-hardhat.ts:48 and :50. An attacker can craft a malicious URL containing injected Node.js code. If a developer downloads the resulting zip archive and executes the tests using npx hardhat test, npm test, or forge test, the injected code executes with the developer's local OS privileges.

Recommendations Upgrade to version 0.10.9.