--- cve: "CVE-2026-57583" severity: "LOW" cvss: 3.3 epss: "13%" vendor: "OpenZeppelin" kev: false exploited: false published: "2026-09-14 18:17:58" tags: [cve, security, low] source: tsecurity.de CVE-Dossier exported: "2026-09-18T11:33:23+02:00" --- # CVE-2026-57583 > 3.3 LOW · 🧪 PoC ## Beschreibung OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages. ## CVSS-Vektor ``` CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Lokal | good | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Erforderlich | good | | S Scope | Unverändert | good | | C Vertraulichkeit | Keine | good | | I Integrität | Gering | warn | | A Verfügbarkeit | Keine | good | ## Patch verfügbar (OSV) - 6b18ecbd727a22d9f8c592e5d56caa2e977fb225 (Commit) ## Referenzen - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-57583) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_