Low, CVSS 3.3npmAmendedPublished
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
CVE-2026-57583 · GHSA-9wxg-vf3r-56hc
- Affected
- npm @openzeppelin/wizard-stellar <= 0.6.1
- Fixed in
- 0.6.2· Vendor fix available
- Issue
- The Contracts Wizard generators printed info.securityContact and info.license verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line terminators. A newline (\n or \r\n) in either field ends the comment, so the text after it is emitted as source rather than remaining inside the comment — allowing arbitrary declarations to be injected into the generated contract. Impact This only matters when these fields are filled from input other than the user who will use the generated contract. Normal self-service use does not meet that condition: - Web app, AI assistant, and CLI: the user supplies these fields and uses their own output, so a line break only affects their own contract. (These fields are not URL-derived, so shared links cannot set them.) - Self-hosted API: same — the end user supplies the options and consumes the result. The case that matters is an integration that fills these fields from untrusted…
Recommended action: Upgrade to 0.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.