OpenZeppelin Contracts Wizard is a web application that helps build smart contracts from OpenZeppelin components. Versions before 0.10.9 generate a Hardhat test file (`test/test.ts`) by embedding user inputs `opts.name` and `opts.uri` directly into TypeScript string literals without escaping. An attacker can craft a URL containing malicious code in these parameters. When a developer downloads the generated zip and runs `npx hardhat test`, the injected Node.js code executes with the developer's OS privileges, leading to potential arbitrary code execution. Version 0.10.9 addresses this vulnerability by fixing the unsafe interpolation.

Successful exploitation allows an attacker to execute arbitrary Node.js code on a developer's machine with the developer's local operating system privileges. This can lead to full compromise of the developer environment, including access to files, credentials, and further network pivoting. The vulnerability requires the developer to download and run the generated test code, but no authentication is required to craft the malicious URL.

Upgrade to OpenZeppelin Contracts Wizard version 0.10.9 or later, which fixes the unsafe code interpolation issue. Until upgrading, avoid downloading and running test files generated from untrusted or suspicious URLs. Exercise caution when using the Contracts Wizard with user-supplied parameters and verify the contents of generated test files before execution.