OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts

Description

The OpenZeppelin Contracts Wizard generated Hardhat (test/test.ts) and Foundry (test/<Name>.t.sol) example test files that interpolated user-supplied strings (opts.name, opts.uri) into the test source without escaping.

Recommendation

Update the @openzeppelin/wizard package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.10.8
• Patched version(s): 0.10.9

References

• GHSA-4x76-22x2-rx8v
• CVE-2026-48054
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Orval has Code Injection via unsanitized x-enum-descriptions using JS comments - CVE-2026-25141
• Orval has a code injection via unsanitized x-enum-descriptions in enum generation - CVE-2026-23947
• i18next-locize-backend has URL Injection via Unsanitized Path Parameters - CVE-2026-41885
• Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check - CVE-2026-31860

You might also like:

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

Host Header Injection and Python Tests with SmartScanner 1.11

How do hackers hack websites?

Tags:

npm

@openzeppelin/wizard