CVE-2026-57583: OpenZeppelin Wizard Code Injection Vulnerability

CVE-2026-57583 Overview

CVE-2026-57583 is a code injection vulnerability [CWE-94] in OpenZeppelin Contracts Wizard, a web application that interactively builds smart contracts from OpenZeppelin components. The setInfo code path emits the info.securityContact and info.license values verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. An attacker who controls those fields can inject a line terminator to close the comment and cause following text to be emitted as source declarations. The issue affects generated-source integrity only. Exploitation requires an integration that populates these fields from untrusted input and a downstream user that consumes the generated source.

Critical Impact
Attackers can inject arbitrary source declarations into generated smart contract code by terminating single-line comments, compromising the integrity of the output consumed by downstream developers.

Affected Products

@openzeppelin/wizard prior to 0.10.11
@openzeppelin/wizard-cairo prior to 3.0.1
@openzeppelin/wizard-stellar prior to 0.6.2 and @openzeppelin/wizard-stylus prior to 0.3.1

Discovery Timeline

2026-09-14 - CVE-2026-57583 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-57583

Vulnerability Analysis

The Contracts Wizard setInfo function renders user-supplied metadata into generated source files. The info.securityContact and info.license values are inserted into single-line // comments without validation for line-terminating characters. A newline (\n), carriage return (\r), or Unicode line separator (U+2028, U+2029) terminates the comment context. Any content following the terminator is emitted at file scope and parsed as source declarations by the target compiler.

This breaks generated-source integrity across Solidity, Cairo, Stellar/Soroban, and Stylus outputs. Downstream developers who trust the Wizard output may compile and deploy a contract that contains injected functions, imports, or state variables. Normal self-service web, AI assistant, CLI, and self-hosted API usage does not cross the trust boundary because the fields are supplied by the same user consuming the output. Shared links cannot set these fields.

Root Cause

The root cause is missing input sanitization on comment-embedded fields. The generator assumes info.securityContact and info.license are single-line strings and does not enforce that invariant. Line terminators embedded in these strings escape the comment context, allowing arbitrary token sequences to be appended to the generated file.

Attack Vector

Exploitation requires an integration that forwards untrusted input into the setInfo call and a victim who consumes the generated source without inspection. The attacker embeds a line terminator followed by malicious source code inside a securityContact or license value. Attack complexity is low but the trust boundary is narrow, limiting real-world reach.

typescript

 import type { ContractBuilder } from './contract';
+import { OptionsError } from './error';
 
 export const SECURITY_CONTACT_DOCUMENTATION = `Security contact: `;
 
+// These values are printed into a // comment line in the generated Cairo. LF
+// ends that comment, letting following text become source. CR and U+2028/U+2029
+// are rejected as defense in depth (review tools render U+2028/U+2029 as line
+// breaks).
+const LINE_TERMINATOR = /[\n\r\\u2028\\u2029]/u;
+
+function checkSingleLine(value: string, field: string): void {
+  if (LINE_TERMINATOR.test(value)) {
+    throw new OptionsError({ [field]: 'Must not contain line breaks' });
+  }
+}
+
 export const infoOptions = [{}, { license: 'WTFPL' }] as const;
 
 export const defaults: Info = { license: 'MIT' };

Source: OpenZeppelin Commit 6b18ecb. The patch introduces a LINE_TERMINATOR regex and a checkSingleLine guard that rejects any info field containing \n, \r, U+2028, or U+2029.

Detection Methods for CVE-2026-57583

Indicators of Compromise

Generated Solidity, Cairo, Stellar/Soroban, or Stylus source files where the Security contact: or license comment line is followed by unexpected top-level declarations.
Contract source containing embedded newline artifacts adjacent to // metadata comments produced by Contracts Wizard.
Build pipelines emitting warnings about unexpected imports or declarations directly after Wizard-generated metadata.

Detection Strategies

Diff generated output against a known-good Wizard template and flag any content appearing after the Security contact: or license comment lines.
Static scan repositories for @openzeppelin/wizard package versions below the fixed releases in package.json and lockfiles.
Inspect integrations that call setInfo and confirm whether securityContact and license are sourced from untrusted input.

Monitoring Recommendations

Monitor CI/CD logs for compilation of Wizard-generated contracts and archive the generated source for post-hoc review.
Track dependency updates in software composition analysis tooling to confirm upgrades to 0.10.11, 3.0.1, 0.6.2, and 0.3.1 where applicable.

How to Mitigate CVE-2026-57583

Immediate Actions Required

Upgrade to @openzeppelin/wizard@0.10.11, @openzeppelin/wizard-cairo@3.0.1, @openzeppelin/wizard-stellar@0.6.2, or @openzeppelin/wizard-stylus@0.3.1 in every project consuming these packages.
Audit any integration that forwards user-controlled data into setInfo and reject or strip line terminators before the call.
Re-review previously generated contract source produced through untrusted integrations for injected declarations.

Patch Information

The fix rejects \n, \r, U+2028, and U+2029 in info.securityContact and info.license, throwing an OptionsError when a line terminator is present. Fixed versions are @openzeppelin/wizard@0.10.11, @openzeppelin/wizard-cairo@3.0.1, @openzeppelin/wizard-stellar@0.6.2, and @openzeppelin/wizard-stylus@0.3.1. See the OpenZeppelin Security Advisory GHSA-9wxg-vf3r-56hc and Pull Request #818.

Workarounds

Validate that securityContact and license values contain no line terminators before invoking setInfo.
Treat Wizard-generated source as untrusted when metadata fields originate from external users, and review the output before compilation.
Restrict setInfo inputs to a fixed allowlist of licenses and contact strings in downstream integrations.

bash

# Upgrade the affected Wizard packages
npm install @openzeppelin/wizard@^0.10.11
npm install @openzeppelin/wizard-cairo@^3.0.1
npm install @openzeppelin/wizard-stellar@^0.6.2
npm install @openzeppelin/wizard-stylus@^0.3.1