Description
The OpenZeppelin Contracts Wizard generated Hardhat (test/test.ts) and Foundry (test/<Name>.t.sol) example test files that interpolated user-supplied strings (opts.name, opts.uri) into the test source without escaping.
Recommendation
Update the @openzeppelin/wizard package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.10.8
- Patched version(s): 0.10.9
References
Could your website be exposed too?
SmartScanner can check your website for OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Orval has Code Injection via unsanitized x-enum-descriptions using JS comments - CVE-2026-25141
- Orval has a code injection via unsanitized x-enum-descriptions in enum generation - CVE-2026-23947
- i18next-locize-backend has URL Injection via Unsanitized Path Parameters - CVE-2026-41885
- Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check - CVE-2026-31860
You might also like:
See something that needs correcting? Let us knowUpdated June 11, 2026