CVE-2026-48054 OpenZeppelin CVE debrief

Who should care

Developers using OpenZeppelin Contracts Wizard, especially those working with ERC20, ERC721, and ERC1155 contracts, should be aware of this vulnerability. They should assess their exposure, review the official advisory, and update to version 0.10.9 or later to prevent code injection attacks. Additionally, security teams and vulnerability management teams should prioritize this update and review compensating controls for exposed systems while remediation is scheduled and verified. Platform operators and security personnel should also review monitoring, detection, and logs for exposed assets that need extra review.

Technical summary

OpenZeppelin Contracts Wizard versions prior to 0.10.9 generate a Hardhat test file by interpolating user-supplied input directly into TypeScript string literals without proper escaping. This allows an attacker to craft a malicious URL that, when downloaded and run, executes injected Node.js code with the developer's local OS privileges. The vulnerability affects ERC20, ERC721, and ERC1155 contracts. Developers should update to version 0.10.9 or later to prevent code injection attacks. The fix involves proper escaping of user-supplied input in the Hardhat test file generation process.

Defensive priority

Developers using OpenZeppelin Contracts Wizard should update to version 0.10.9 to prevent code injection attacks.

Recommended defensive actions

• Update OpenZeppelin Contracts Wizard to version 0.10.9 or later
• Review and validate user-supplied input to prevent code injection attacks
• Implement secure coding practices to prevent similar vulnerabilities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-48054 record indicates that OpenZeppelin Contracts Wizard versions prior to 0.10.9 are vulnerable to code injection attacks. An attacker can craft a malicious URL that, when downloaded and run, executes injected Node.js code with the developer's local OS privileges. To verify, defenders should review the official advisory, assess their exposure, and validate their update process. OpenZeppelin has provided a patched version (0.10.9) that properly escapes user-supplied input. Evidence is limited to public sources and may not cover all affected deployments.

Official resources