OpenZeppelin Contracts Wizard versions prior to 0.10.11 (@openzeppelin/wizard), 3.0.1 (@openzeppelin/wizard-cairo), 0.6.2 (@openzeppelin/wizard-stellar), and 0.3.1 (@openzeppelin/wizard-stylus) contain a code injection vulnerability (CWE-94) due to improper handling of info.securityContact and info.license fields. These fields are printed verbatim into single-line comments in generated source code for Solidity, Cairo, Stellar/Soroban, and Stylus. Because a line terminator ends the comment, an attacker controlling these fields via an integration that feeds untrusted input can inject source code declarations. However, typical usage modes (web, AI assistant, CLI, self-hosted API) do not allow untrusted input to reach these fields, and shared links cannot set them. No code executes on the Wizard service, so the impact is limited to generated source integrity. The issue is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 respectively.

The vulnerability allows an attacker who can supply untrusted input to the securityContact or license fields in an integration to inject code into the generated source code output. This compromises the integrity of the generated source but does not affect confidentiality or availability. There is no indication of active exploitation in the wild. Normal users of the service are not exposed to this risk because the trust boundary is not crossed in typical usage.

This vulnerability is fixed in OpenZeppelin Contracts Wizard versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 for the respective packages. Users should upgrade to these versions or later to remediate the issue. Since this is not a cloud service, remediation requires updating the affected packages. No additional mitigation is required if upgrading is performed.