{"id":"CVE-2026-57583","summary":"OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source","details":"OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.","aliases":["GHSA-9wxg-vf3r-56hc"],"modified":"2026-09-16T03:47:08.254615231Z","published":"2026-09-14T17:44:45.248Z","database_specific":{"cwe_ids":["CWE-116","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57583.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-cairo@3.0.1"},{"type":"WEB","url":"https://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-stellar@0.6.2"},{"type":"WEB","url":"https://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard-stylus@0.3.1"},{"type":"WEB","url":"https://github.com/OpenZeppelin/contracts-wizard/releases/tag/@openzeppelin/wizard@0.10.11"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57583.json"},{"type":"ADVISORY","url":"https://github.com/OpenZeppelin/contracts-wizard/security/advisories/GHSA-9wxg-vf3r-56hc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57583"},{"type":"FIX","url":"https://github.com/OpenZeppelin/contracts-wizard/commit/6b18ecbd727a22d9f8c592e5d56caa2e977fb225"},{"type":"FIX","url":"https://github.com/OpenZeppelin/contracts-wizard/pull/818"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openzeppelin/contracts-wizard","events":[{"introduced":"0"},{"fixed":"6b18ecbd727a22d9f8c592e5d56caa2e977fb225"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"0.10.11"},{"fixed":"3.0.1"},{"fixed":"0.6.2"},{"fixed":"0.3.1"}]}}],"versions":["@openzeppelin/wizard@0.10.10","@openzeppelin/wizard-stellar@0.6.1","@openzeppelin/wizard-confidential@0.1.2","@openzeppelin/wizard-common@0.5.2","@openzeppelin/contracts-mcp@0.5.9","@openzeppelin/contracts-cli@0.1.2","@openzeppelin/wizard@0.10.9","@openzeppelin/wizard-common@0.5.1","@openzeppelin/wizard-stellar@0.6.0","@openzeppelin/contracts-mcp@0.5.8","@openzeppelin/contracts-cli@0.1.1","@openzeppelin/wizard@0.10.8","@openzeppelin/wizard-uniswap-hooks@0.1.1","@openzeppelin/wizard-confidential@0.1.1","@openzeppelin/wizard-common@0.5.0","@openzeppelin/contracts-mcp@0.5.7","@openzeppelin/contracts-cli@0.1.0","@openzeppelin/contracts-mcp@0.5.6","@openzeppelin/wizard@0.10.7","@openzeppelin/wizard-common@0.4.4","@openzeppelin/contracts-mcp@0.5.5","@openzeppelin/contracts-mcp@0.5.4","@openzeppelin/wizard@0.10.6","@openzeppelin/wizard-confidential@0.1.0","@openzeppelin/wizard-common@0.4.3","@openzeppelin/contracts-mcp@0.5.3","@openzeppelin/wizard-stellar@0.5.0","@openzeppelin/wizard-common@0.4.2","@openzeppelin/contracts-mcp@0.5.2","@openzeppelin/wizard@0.10.5","@openzeppelin/wizard-stellar@0.4.5","@openzeppelin/wizard-common@0.4.1","@openzeppelin/contracts-mcp@0.5.1","@openzeppelin/wizard-common@0.4.0","@openzeppelin/wizard-cairo@3.0.0","@openzeppelin/contracts-mcp@0.5.0","@openzeppelin/wizard-stylus@0.3.0","@openzeppelin/contracts-mcp@0.4.6","@openzeppelin/contracts-mcp@0.4.5","@openzeppelin/wizard@0.10.4","@openzeppelin/wizard-uniswap-hooks@0.1.0","@openzeppelin/wizard-common@0.3.3","@openzeppelin/contracts-mcp@0.4.4","@openzeppelin/wizard@0.10.3","@openzeppelin/wizard-stellar@0.4.4","@openzeppelin/wizard-common@0.3.2","@openzeppelin/contracts-mcp@0.4.3","@openzeppelin/wizard@0.10.2","@openzeppelin/wizard-common@0.3.1","@openzeppelin/contracts-mcp@0.4.2","@openzeppelin/wizard@0.10.0","@openzeppelin/wizard-common@0.2.0","@openzeppelin/contracts-mcp@0.4.0","@openzeppelin/wizard@0.9.0","@openzeppelin/wizard-common@0.1.2","@openzeppelin/contracts-mcp@0.3.0","@openzeppelin/wizard@0.8.1","@openzeppelin/wizard-stellar@0.4.3","@openzeppelin/wizard@0.8.0","@openzeppelin/wizard-common@0.1.1","@openzeppelin/wizard-cairo@2.1.0","@openzeppelin/contracts-mcp@0.2.0","@openzeppelin/wizard-cairo@2.0.1","@openzeppelin/wizard@0.7.1","@openzeppelin/wizard-common@0.1.0","@openzeppelin/contracts-mcp@0.1.0","@openzeppelin/wizard@0.7.0","@openzeppelin/wizard-common@0.0.3","@openzeppelin/contracts-mcp@0.0.7","@openzeppelin/contracts-mcp@0.0.6","@openzeppelin/contracts-mcp@0.0.5","@openzeppelin/wizard-stellar@0.4.2","@openzeppelin/wizard-stellar@0.4.1","@openzeppelin/wizard-mcp@0.0.4","@openzeppelin/wizard-stylus@0.2.0","@openzeppelin/wizard-stellar@0.3.0","@openzeppelin/wizard-mcp@0.0.3","@openzeppelin/wizard-common@0.0.2","@openzeppelin/wizard-stellar@0.2.3","@openzeppelin/wizard-mcp@0.0.2","@openzeppelin/wizard@0.6.0","@openzeppelin/wizard-stylus@0.2.0-alpha.5","@openzeppelin/wizard-stellar@0.2.2","@openzeppelin/wizard-mcp@0.0.1","@openzeppelin/wizard-common@0.0.1","@openzeppelin/wizard-cairo@2.0.0","@openzeppelin/wizard-stellar@0.2.1","@openzeppelin/wizard@0.5.6","@openzeppelin/wizard@0.5.5","@openzeppelin/wizard-stellar@0.2.0","@openzeppelin/wizard-cairo@1.1.0","@openzeppelin/wizard@0.5.4","@openzeppelin/wizard@0.5.3","@openzeppelin/wizard-stylus@0.2.0-alpha.4","@openzeppelin/wizard-stylus@0.2.0-alpha.3","@openzeppelin/wizard-stellar@0.1.1","@openzeppelin/wizard-stellar@0.1.0","@openzeppelin/wizard-cairo@1.0.0","@openzeppelin/wizard@0.5.2","@openzeppelin/wizard@0.5.1","@openzeppelin/wizard@0.5.0","@openzeppelin/wizard-cairo@0.21.1","@openzeppelin/wizard-cairo@0.21.0","@openzeppelin/wizard-cairo@0.20.1","@openzeppelin/wizard-cairo@0.20.0","@openzeppelin/wizard-cairo@0.19.0","@openzeppelin/wizard@0.4.6","@openzeppelin/wizard@0.4.5","@openzeppelin/wizard-cairo@0.18.0","@openzeppelin/wizard@0.4.4","@openzeppelin/wizard-cairo@0.17.0","@openzeppelin/wizard-cairo@0.16.0","@openzeppelin/wizard-cairo@0.15.0","@openzeppelin/wizard-cairo@0.14.0","@openzeppelin/wizard-cairo@0.13.0","@openzeppelin/wizard-cairo@0.12.0","@openzeppelin/wizard-cairo@0.11.0","@openzeppelin/wizard@0.4.3","@openzeppelin/wizard-cairo@0.10.2","@openzeppelin/wizard-cairo@0.10.1","@openzeppelin/wizard-cairo@0.10.0","@openzeppelin/wizard-cairo@0.9.2","@openzeppelin/wizard@0.4.2","@openzeppelin/wizard-cairo@0.9.1","@openzeppelin/wizard-cairo@0.9.0","@openzeppelin/wizard-cairo@0.8.0","@openzeppelin/wizard@0.4.1","@openzeppelin/wizard@0.4.0","@openzeppelin/wizard@0.3.0","@openzeppelin/wizard@0.2.3","@openzeppelin/wizard@0.2.2","@openzeppelin/wizard@0.2.1","@openzeppelin/wizard-cairo@0.6.0","@openzeppelin/wizard@0.2.0","@openzeppelin/wizard-cairo@0.5.0","@openzeppelin/wizard-cairo@0.4.0","@openzeppelin/wizard-cairo@0.3.1","@openzeppelin/wizard-cairo@0.3.0","@openzeppelin/wizard@0.1.1","@openzeppelin/wizard@0.1.0","@openzeppelin/wizard-cairo@0.2.0","@openzeppelin/wizard-cairo@0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57583.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}