Description

OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721) and `opts.uri` (ERC1155) directly into TypeScript string literals at `zip-hardhat.ts:48` and `:50` without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as `https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=");require("child_process").execSync("...");("` and shares it with a developer. When the victim downloads the resulting zip archive and runs `npx hardhat test`, the injected Node.js code executes with the developer's local OS privileges. Version 0.10.9 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-06T22:17:09.530Z",
  "pubdate": "2026-08-06T22:17:09.530Z",
  "executiveSummary": "A code injection vulnerability exists in the OpenZeppelin Contracts Wizard web application in versions prior to 0.10.9. The vulnerability allows unauthenticated attackers to achieve Remote Code Execution (RCE) with local operating system privileges when a developer executes generated Hardhat test files. The flaw arises from improper handling of user-supplied inputs, specifically opts.name for ERC20 and ERC721 contracts and opts.uri for ERC1155 contracts, which are directly interpolated into TypeScript string literals within zip-hardhat.ts without proper escaping. An attacker can craft a malicious URL containing arbitrary Node.js execution payloads and trick a victim into downloading the generated project archive and executing tests via npx hardhat test. This poses severe risk implications, as successful exploitation compromises the developer's local workstation environment, allowing arbitrary command execution under the user's security context. Mitigation requires upgrading the affected application or libraries to version 0.10.9 or later, where proper string escaping is enforced.",
  "technicalDetails": "The vulnerability stems from an insecure string interpolation flaw located in the OpenZeppelin Contracts Wizard codebase, specifically affecting zip-hardhat.ts at lines 48 and 50. The application generates a Hardhat test file (test/test.ts) for exported contract packages by embedding user-provided parameters directly into TypeScript source code strings without applying any sanitation, encoding, or JavaScript/TypeScript string escaping mechanisms.\nThe vulnerable component is the archive generation module of the web application, specifically affecting versions prior to 0.10.9. No authentication is required to interact with the web interface or construct the malicious parameters. Network exposure is present via the public-facing web application hosted at https://wizard.openzeppelin.com/. Attackers require no initial system privileges on the target machine, relying instead on social engineering or user interaction to induce the victim into downloading and executing the generated code.\nThe exploitation vector relies on URL parameter manipulation. An attacker crafts a malicious URL pointing to the OpenZeppelin Contracts Wizard interface, appending a payload within the configuration parameters, such as https://wizard.openzeppelin.com/#/erc20?name=\");require(\"child_process\").execSync(\"...\");(\". When a victim visits the crafted URL, the web application generates a downloadable zip archive containing the contaminated test/test.ts file, where the malicious payload is seamlessly integrated into the generated TypeScript test suite.\nThe attack flow proceeds as follows: First, the attacker constructs and distributes the malicious URL to the target developer. Second, the developer accesses the link, configures or accepts the contract parameters, and downloads the generated Hardhat project archive. Third, the developer extracts the archive locally and executes the test suite using the standard command npx hardhat test. Fourth, as the Hardhat environment compiles and runs the TypeScript test files, the injected Node.js code executes. The payload leverages native Node.js modules such as child_process to execute arbitrary system commands, resulting in full local OS command execution under the privileges of the developer account."
}