OpenZeppelin Contracts Wizard versions before 0.10.9 contain a code injection vulnerability (CWE-94) due to improper control of code generation. Specifically, user inputs `opts.name` and `opts.uri` are interpolated directly into a Hardhat test file's TypeScript string literals without JavaScript string escaping at zip-hardhat.ts lines 48 and 50. An attacker can craft a URL embedding malicious Node.js code that executes when the developer downloads the generated zip and runs `npx hardhat test`. This leads to arbitrary code execution with the developer's local OS privileges. Version 0.10.9 addresses this vulnerability.

Successful exploitation allows an attacker to execute arbitrary Node.js code on the developer's machine with their local OS privileges when running the generated Hardhat test. This can lead to full compromise of the developer environment, including data theft, system manipulation, or further attacks. No authentication is required to trigger this vulnerability, increasing its risk.

Upgrade to OpenZeppelin contracts-wizard version 0.10.9 or later, which fixes this code injection vulnerability by properly escaping user inputs in generated test files. Until upgrading, avoid running Hardhat tests generated from untrusted or suspicious URLs. There is no vendor advisory explicitly stating no action is required or that the issue is already mitigated, so applying the official fix is recommended.