{"id":"EUVD-2026-77702","enisaUuid":"5da6b76d-c161-3a6a-b096-d282b01e2587","description":"OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.","datePublished":"Sep 14, 2026, 5:44:45 PM","dateUpdated":"Sep 14, 2026, 7:06:58 PM","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://github.com/OpenZeppelin/contracts-wizard/security/advisories/GHSA-9wxg-vf3r-56hc\nhttps://github.com/OpenZeppelin/contracts-wizard/pull/818\nhttps://github.com/OpenZeppelin/contracts-wizard/commit/6b18ecbd727a22d9f8c592e5d56caa2e977fb225\nhttps://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-cairo@3.0.1\nhttps://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-stellar@0.6.2\nhttps://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-stylus@0.3.1\nhttps://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard@0.10.11\n","aliases":"CVE-2026-57583\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"6f300e17-3513-30e5-9c22-02e2303181b3","product":{"name":"wizard","vendor":{"name":"@openzeppelin"}},"product_version":"\u003c 0.10.11"},{"id":"a3668a4f-94c6-3f24-bf80-c2f1510c6a46","product":{"name":"contracts-wizard","vendor":{"name":"OpenZeppelin"}},"product_version":"\u003c 0.10.11"},{"id":"c2c3467c-e966-3031-9cc3-cd9612228523","product":{"name":"wizard-cairo","vendor":{"name":"@openzeppelin"}},"product_version":"\u003c 3.0.1"},{"id":"dc680465-ea5a-3cc5-bab6-0f543c33670b","product":{"name":"wizard-stellar","vendor":{"name":"@openzeppelin"}},"product_version":"\u003c 0.6.2"},{"id":"f2c21180-a298-3e9a-b1c5-15773b41af67","product":{"name":"wizard-stylus","vendor":{"name":"@openzeppelin"}},"product_version":"\u003c 0.3.1"}],"enisaIdVendor":[{"id":"87266f9e-26b7-3c25-93c3-ef377a8189cb","vendor":{"name":"OpenZeppelin"}},{"id":"d6048675-8d7a-38ee-9cbb-0e2b77d9f3be","vendor":{"name":"@openzeppelin"}}],"enisaIdVulnerability":[{"id":"6dde2030-ad16-32f9-a93d-c03bdf695e12","vulnerability":{"id":"CVE-2026-57583","description":"OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.","datePublished":"Sep 14, 2026, 5:44:45 PM","dateUpdated":"Sep 14, 2026, 7:06:58 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://github.com/OpenZeppelin/contracts-wizard/security/advisories/GHSA-9wxg-vf3r-56hc\nhttps://github.com/OpenZeppelin/contracts-wizard/pull/818\nhttps://github.com/OpenZeppelin/contracts-wizard/commit/6b18ecbd727a22d9f8c592e5d56caa2e977fb225\nhttps://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-cairo@3.0.1\nhttps://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-stellar@0.6.2\nhttps://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-stylus@0.3.1\nhttps://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard@0.10.11\n","enisa_id":"EUVD-2026-77702\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Oct 28, 2026, 7:16:21 AM","vulnerabilityProduct":[{"id":"0e9eb285-4791-35de-a82d-0b902f47029b","product":{"name":"wizard-cairo","vendor":{"name":"@openzeppelin"}},"product_version":"\u003c 3.0.1"},{"id":"74cfca7a-29b3-3c86-bb57-c9c4e036c6c7","product":{"name":"wizard","vendor":{"name":"@openzeppelin"}},"product_version":"\u003c 0.10.11"},{"id":"81c40485-9983-365f-927b-a8971a415c1e","product":{"name":"wizard-stylus","vendor":{"name":"@openzeppelin"}},"product_version":"\u003c 0.3.1"},{"id":"9ce5a9f6-3ddd-3f2c-a5ee-bc4c3d9cb76a","product":{"name":"wizard-stellar","vendor":{"name":"@openzeppelin"}},"product_version":"\u003c 0.6.2"},{"id":"ec7a4b0b-a9a8-3e76-8cd9-b1296bb01680","product":{"name":"contracts-wizard","vendor":{"name":"OpenZeppelin"}},"product_version":"\u003c 0.10.11"}],"vulnerabilityVendor":[{"id":"2c7a58a0-697e-32ce-8a45-196f3a4fb847","vendor":{"name":"OpenZeppelin"}},{"id":"dd733af1-a290-3f8e-baf6-5b3f479df4d8","vendor":{"name":"@openzeppelin"}}]}}],"enisaIdAdvisory":[]}