Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. @openzeppelin/wizard-stellar
  4. ›
  5. GHSA-9wxg-vf3r-56hc

GHSA-9wxg-vf3r-56hc: OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

June 19, 2026

The Contracts Wizard generators printed info.securityContact and info.license verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line terminators. A newline (\n or \r\n) in either field ends the comment, so the text after it is emitted as source rather than remaining inside the comment — allowing arbitrary declarations to be injected into the generated contract.

References

  • github.com/OpenZeppelin/contracts-wizard/security/advisories/GHSA-9wxg-vf3r-56hc
  • github.com/advisories/GHSA-9wxg-vf3r-56hc

Code Behaviors & Features

Detect and mitigate GHSA-9wxg-vf3r-56hc with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.6.2

Fixed versions

  • 0.6.2

Solution

Upgrade to version 0.6.2 or above.

Impact 3.3 LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Learn more about CVSS

Weakness

  • CWE-116: Improper Encoding or Escaping of Output
  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Source file

npm/@openzeppelin/wizard-stellar/GHSA-9wxg-vf3r-56hc.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 23 Jun 2026 12:24:19 +0000.