{"id":5059,"date":"2026-09-04T18:46:58","date_gmt":"2026-09-04T10:46:58","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-48054"},"modified":"2026-09-04T18:46:58","modified_gmt":"2026-09-04T10:46:58","slug":"cve-2026-48054","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-48054","title":{"rendered":"CVE-2026-48054 [HIGH] &#8211; OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of"},"content":{"rendered":"<p>OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test\/test.ts`) by interpolating user-supplied `opts.name` (ERC20\/ERC721) and `opts.uri` (ERC1155) directly into TypeScript string literals at `zip-hardhat.ts:48` and `:50` without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as `https[:]\/\/wizard[.]openzeppelin[.]com\/#\/erc20?name=&#8221;);require(&#8220;child_process&#8221;).execSync(&#8220;&#8230;&#8221;);(&#8220;` and shares it with a developer. When the victim downloads the resulting zip archive and runs `npx hardhat test`, the injected Node.js code executes with the developer&#8217;s local OS privileges. Version 0.10.9 fixes the issue.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test\/test.ts`<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5059","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5059","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5059"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5059"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5059"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}