Remote Code Execution Vulnerability in OpenZeppelin Contracts Wizard
CVE-2026-48054

8.8HIGH

Key Information:

Vendor

Openzeppelin

Status
Contracts-wizard
Vendor
CVE Published:
6 August 2026

What is CVE-2026-48054?

The OpenZeppelin Contracts Wizard is a web application that allows developers to build smart contracts interactively. In prior versions before 0.10.9, the application improperly handles user input, specifically around generating Hardhat test files. This oversight enables malicious actors to inject harmful Node.js code into these files via crafted URLs. When an unsuspecting developer unwittingly executes the generated test, it can lead to the execution of arbitrary code on their local system with their privileges. Users are strongly urged to upgrade to version 0.10.9 or later to mitigate this risk.

Affected Version(s)

contracts-wizard < 0.10.9

References

https://github.com/OpenZeppelin/contracts-wizard/security...
x_refsource_CONFIRM
https://github.com/OpenZeppelin/contracts-wizard/commit/e...
x_refsource_MISC
https://github.com/OpenZeppelin/contracts-wizard/releases...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.