https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:10:24 +0000 https://vulnerability.circl.lu/vuln/cve-2026-48054 <p><strong>Affected:</strong> OpenZeppelin contracts-wizard</p> <p>OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721) and `opts.uri` (ERC1155) directly into TypeScript string literals at `zip-hardhat.ts:48` and `:50` without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as `https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=&#34;);require(&#34;child_process&#34;).execSync(&#34;...&#34;);(&#34;` and shares it with a developer. When the victim downloads the resulting zip archive and runs `npx hardhat test`, the injected Node.js code executes with the developer&#39;s local OS privileges. Version 0.10.9 fixes the issue.</p> <p><strong>Affected:</strong> OpenZeppelin contracts-wizard</p> <p>OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721) and `opts.uri` (ERC1155) directly into TypeScript string literals at `zip-hardhat.ts:48` and `:50` without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as `https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=&#34;);require(&#34;child_process&#34;).execSync(&#34;...&#34;);(&#34;` and shares it with a developer. When the victim downloads the resulting zip archive and runs `npx hardhat test`, the injected Node.js code executes with the developer&#39;s local OS privileges. Version 0.10.9 fixes the issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-48054