8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48054

CVE-2026-48054: OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

Summary

The OpenZeppelin Contracts Wizard generated Hardhat (test/test.ts) and Foundry (test/<Name>.t.sol) example test files that interpolated user-supplied strings (opts.name, opts.uri) into the test source without escaping. A crafted input could produce a generated test file in which the input string broke out of its surrounding literal and was parsed as code, executing when a developer ran npm test or forge test on the downloaded project.

Impact

Users of the hosted Wizard at https://wizard.openzeppelin.com: no action required. The site has been redeployed with the fix.
Users of @openzeppelin/wizard via the documented public API: not affected. The vulnerable functions (zipHardhat, zipFoundry) are not part of the package's documented public exports.
Callers of zipHardhat / zipFoundry who forward externally-controlled strings into opts.name / opts.uri: upgrade to 0.10.9.

Patches

Fixed in @openzeppelin/wizard@0.10.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48054

CVE-2026-48054:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@openzeppelin/wizard	npm	<= 0.10.8	0.10.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the OpenZeppelin Contracts Wizard's generation of Hardhat and Foundry test files. The zipHardhat and zipFoundry functions, which are responsible for creating these test files, failed to properly sanitize user-provided input for the opts.name and opts.uri parameters. The patch reveals that these inputs were directly interpolated into the test file's source code. This allows an attacker to craft a malicious string that breaks out of the intended string literal in the generated code and injects arbitrary code. This injected code would then be executed when a developer runs the tests (npm test or forge test). The fix involves replacing the direct string interpolation with calls to sanitization functions (JSON.stringify for Hardhat and a new, more robust stringifyUnicodeSafe for Foundry) to ensure that user input is always treated as a string literal and cannot be interpreted as code.

Vulnerable functions

zipFoundry

packages/core/solidity/src/zip-foundry.ts

The `zipFoundry` function generates a Foundry test file. It uses an internal `test` function that directly interpolated the user-provided `opts.name` and `opts.uri` values into the generated test source code without proper escaping. A malicious value could break out of the string literal and be executed as code when the tests are run.

zipHardhat

packages/core/solidity/src/zip-hardhat.ts

The `zipHardhat` function generates a Hardhat test file. It uses a `TestGenerator` class whose `getExpect` method directly interpolated the user-provided `opts.name` and `opts.uri` values into the generated test source code without proper escaping. A malicious value could break out of the string literal and be executed as code when the tests are run.

stringifyUnicodeSafe

packages/core/solidity/src/utils/sanitize.ts

The original `stringifyUnicodeSafe` function was intended to sanitize strings for inclusion in Solidity code. However, its implementation was insufficient, as it did not properly escape all characters that could be used to break out of a string literal in the generated test files. The fix involved a more robust implementation that correctly handles unicode and escape sequences according to Solidity's grammar.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.