Answer in brief
CVE-2026-57583 records a Unknown severity vulnerability in OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source. The current sources do not mark it as known exploited. The current feed maps OpenZeppelin/contracts-wizard (generic), @openzeppelin/wizard (generic), @openzeppelin/wizard-cairo (generic), @openzeppelin/wizard-stellar (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps OpenZeppelin/contracts-wizard (generic), @openzeppelin/wizard (generic), @openzeppelin/wizard-cairo (generic), @openzeppelin/wizard-stellar (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| OpenZeppelin/contracts-wizardgeneric | < 0.10.11 | Not reported |
| @openzeppelin/wizardgeneric | < 0.10.11 | Not reported |
| @openzeppelin/wizard-cairogeneric | < 3.0.1 | Not reported |
| @openzeppelin/wizard-stellargeneric | < 0.6.2 | Not reported |
| @openzeppelin/wizard-stylusgeneric | < 0.3.1 | Not reported |
Published upstream
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 14, 2026
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.
Quoted source text, attributed separately from HOL analysis.