CVE-2026-48054

npm/@openzeppelin/wizard CVE-2026-48054: high 8.8

OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

Action: Upgrade @openzeppelin/wizard to 0.10.9 or later.

npm i @openzeppelin/wizard@0.10.9

Affected

Fixed versions

Sources

• osv: GHSA-4x76-22x2-rx8v
• https://github.com/OpenZeppelin/contracts-wizard/security/advisories/GHSA-4x76-22x2-rx8v
• https://github.com/OpenZeppelin/contracts-wizard/commit/ec12c44f8d9e0491eba31037f95b36e98ec58b5f
• https://github.com/OpenZeppelin/contracts-wizard
• https://github.com/OpenZeppelin/contracts-wizard/releases/tag/%40openzeppelin%2Fwizard%400.10.9

CVE-2026-48054 · published 2026-06-11T13:27:24Z · modified 2026-09-10T03:50:48.266458420Z · JSON