CVE-2026-57583

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57583
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57583.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57583
Aliases
Published
2026-09-14T17:44:45Z
Modified
2026-09-16T03:47:08Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
Details

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-116",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57583.json"
}
References

Affected packages

Git / github.com/openzeppelin/contracts-wizard

Affected ranges

Type
GIT
Repo
https://github.com/openzeppelin/contracts-wizard
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b18ecbd727a22d9f8c592e5d56caa2e977fb225
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.10.11"
        },
        {
            "fixed": "3.0.1"
        },
        {
            "fixed": "0.6.2"
        },
        {
            "fixed": "0.3.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

@openzeppelin/contracts-cli@0.*
@openzeppelin/contracts-cli@0.1.0
@openzeppelin/contracts-cli@0.1.1
@openzeppelin/contracts-cli@0.1.2
@openzeppelin/contracts-mcp@0.*
@openzeppelin/contracts-mcp@0.0.5
@openzeppelin/contracts-mcp@0.0.6
@openzeppelin/contracts-mcp@0.0.7
@openzeppelin/contracts-mcp@0.1.0
@openzeppelin/contracts-mcp@0.2.0
@openzeppelin/contracts-mcp@0.3.0
@openzeppelin/contracts-mcp@0.4.0
@openzeppelin/contracts-mcp@0.4.2
@openzeppelin/contracts-mcp@0.4.3
@openzeppelin/contracts-mcp@0.4.4
@openzeppelin/contracts-mcp@0.4.5
@openzeppelin/contracts-mcp@0.4.6
@openzeppelin/contracts-mcp@0.5.0
@openzeppelin/contracts-mcp@0.5.1
@openzeppelin/contracts-mcp@0.5.2
@openzeppelin/contracts-mcp@0.5.3
@openzeppelin/contracts-mcp@0.5.4
@openzeppelin/contracts-mcp@0.5.5
@openzeppelin/contracts-mcp@0.5.6
@openzeppelin/contracts-mcp@0.5.7
@openzeppelin/contracts-mcp@0.5.8
@openzeppelin/contracts-mcp@0.5.9
@openzeppelin/wizard-cairo@0.*
@openzeppelin/wizard-cairo@0.1.0
@openzeppelin/wizard-cairo@0.10.0
@openzeppelin/wizard-cairo@0.10.1
@openzeppelin/wizard-cairo@0.10.2
@openzeppelin/wizard-cairo@0.11.0
@openzeppelin/wizard-cairo@0.12.0
@openzeppelin/wizard-cairo@0.13.0
@openzeppelin/wizard-cairo@0.14.0
@openzeppelin/wizard-cairo@0.15.0
@openzeppelin/wizard-cairo@0.16.0
@openzeppelin/wizard-cairo@0.17.0
@openzeppelin/wizard-cairo@0.18.0
@openzeppelin/wizard-cairo@0.19.0
@openzeppelin/wizard-cairo@0.2.0
@openzeppelin/wizard-cairo@0.20.0
@openzeppelin/wizard-cairo@0.20.1
@openzeppelin/wizard-cairo@0.21.0
@openzeppelin/wizard-cairo@0.21.1
@openzeppelin/wizard-cairo@0.3.0
@openzeppelin/wizard-cairo@0.3.1
@openzeppelin/wizard-cairo@0.4.0
@openzeppelin/wizard-cairo@0.5.0
@openzeppelin/wizard-cairo@0.6.0
@openzeppelin/wizard-cairo@0.8.0
@openzeppelin/wizard-cairo@0.9.0
@openzeppelin/wizard-cairo@0.9.1
@openzeppelin/wizard-cairo@0.9.2
@openzeppelin/wizard-cairo@1.*
@openzeppelin/wizard-cairo@1.0.0
@openzeppelin/wizard-cairo@1.1.0
@openzeppelin/wizard-cairo@2.*
@openzeppelin/wizard-cairo@2.0.0
@openzeppelin/wizard-cairo@2.0.1
@openzeppelin/wizard-cairo@2.1.0
@openzeppelin/wizard-cairo@3.*
@openzeppelin/wizard-cairo@3.0.0
@openzeppelin/wizard-common@0.*
@openzeppelin/wizard-common@0.0.1
@openzeppelin/wizard-common@0.0.2
@openzeppelin/wizard-common@0.0.3
@openzeppelin/wizard-common@0.1.0
@openzeppelin/wizard-common@0.1.1
@openzeppelin/wizard-common@0.1.2
@openzeppelin/wizard-common@0.2.0
@openzeppelin/wizard-common@0.3.1
@openzeppelin/wizard-common@0.3.2
@openzeppelin/wizard-common@0.3.3
@openzeppelin/wizard-common@0.4.0
@openzeppelin/wizard-common@0.4.1
@openzeppelin/wizard-common@0.4.2
@openzeppelin/wizard-common@0.4.3
@openzeppelin/wizard-common@0.4.4
@openzeppelin/wizard-common@0.5.0
@openzeppelin/wizard-common@0.5.1
@openzeppelin/wizard-common@0.5.2
@openzeppelin/wizard-confidential@0.*
@openzeppelin/wizard-confidential@0.1.0
@openzeppelin/wizard-confidential@0.1.1
@openzeppelin/wizard-confidential@0.1.2
@openzeppelin/wizard-mcp@0.*
@openzeppelin/wizard-mcp@0.0.1
@openzeppelin/wizard-mcp@0.0.2
@openzeppelin/wizard-mcp@0.0.3
@openzeppelin/wizard-mcp@0.0.4
@openzeppelin/wizard-stellar@0.*
@openzeppelin/wizard-stellar@0.1.0
@openzeppelin/wizard-stellar@0.1.1
@openzeppelin/wizard-stellar@0.2.0
@openzeppelin/wizard-stellar@0.2.1
@openzeppelin/wizard-stellar@0.2.2
@openzeppelin/wizard-stellar@0.2.3
@openzeppelin/wizard-stellar@0.3.0
@openzeppelin/wizard-stellar@0.4.1
@openzeppelin/wizard-stellar@0.4.2
@openzeppelin/wizard-stellar@0.4.3
@openzeppelin/wizard-stellar@0.4.4
@openzeppelin/wizard-stellar@0.4.5
@openzeppelin/wizard-stellar@0.5.0
@openzeppelin/wizard-stellar@0.6.0
@openzeppelin/wizard-stellar@0.6.1
@openzeppelin/wizard-stylus@0.*
@openzeppelin/wizard-stylus@0.2.0
@openzeppelin/wizard-stylus@0.2.0-alpha.3
@openzeppelin/wizard-stylus@0.2.0-alpha.4
@openzeppelin/wizard-stylus@0.2.0-alpha.5
@openzeppelin/wizard-stylus@0.3.0
@openzeppelin/wizard-uniswap-hooks@0.*
@openzeppelin/wizard-uniswap-hooks@0.1.0
@openzeppelin/wizard-uniswap-hooks@0.1.1
@openzeppelin/wizard@0.*
@openzeppelin/wizard@0.1.0
@openzeppelin/wizard@0.1.1
@openzeppelin/wizard@0.10.0
@openzeppelin/wizard@0.10.10
@openzeppelin/wizard@0.10.2
@openzeppelin/wizard@0.10.3
@openzeppelin/wizard@0.10.4
@openzeppelin/wizard@0.10.5
@openzeppelin/wizard@0.10.6
@openzeppelin/wizard@0.10.7
@openzeppelin/wizard@0.10.8
@openzeppelin/wizard@0.10.9
@openzeppelin/wizard@0.2.0
@openzeppelin/wizard@0.2.1
@openzeppelin/wizard@0.2.2
@openzeppelin/wizard@0.2.3
@openzeppelin/wizard@0.3.0
@openzeppelin/wizard@0.4.0
@openzeppelin/wizard@0.4.1
@openzeppelin/wizard@0.4.2
@openzeppelin/wizard@0.4.3
@openzeppelin/wizard@0.4.4
@openzeppelin/wizard@0.4.5
@openzeppelin/wizard@0.4.6
@openzeppelin/wizard@0.5.0
@openzeppelin/wizard@0.5.1
@openzeppelin/wizard@0.5.2
@openzeppelin/wizard@0.5.3
@openzeppelin/wizard@0.5.4
@openzeppelin/wizard@0.5.5
@openzeppelin/wizard@0.5.6
@openzeppelin/wizard@0.6.0
@openzeppelin/wizard@0.7.0
@openzeppelin/wizard@0.7.1
@openzeppelin/wizard@0.8.0
@openzeppelin/wizard@0.8.1
@openzeppelin/wizard@0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57583.json"