{"data":{"id":"f5a9194a-9497-4558-8943-0d6b1bcfdaf7","title":"GHSA-9wxg-vf3r-56hc: OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source","summary":"The OpenZeppelin Contracts Wizard generators printed info.securityContact and info.license into a single-line comment in generated Solidity, Cairo, Stellar/Soroban and Stylus source without rejecting line terminators. A newline (\\n or \\r\\n) in either field ends the comment, letting arbitrary declarations be injected into the generated contract. The impact is integrity-only and matters only when these fields are filled from untrusted input, such as an MCP agent whose tool arguments derive from processed content.","solution":"Fixed by rejecting line terminators in setInfo, the single code path all surfaces use. Upgrade to the patched versions. @openzeppelin/wizard-confidential and @openzeppelin/wizard-uniswap-hooks receive the fix once their @openzeppelin/wizard dependency is updated to a patched version.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-9wxg-vf3r-56hc","publishedAt":"2026-06-19T17:45:15.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@openzeppelin/wizard-stylus@<= 0.3.0 (fixed: 0.3.1)","@openzeppelin/wizard-stellar@<= 0.6.1 (fixed: 0.6.2)","@openzeppelin/wizard-cairo@<= 3.0.0 (fixed: 3.0.1)","@openzeppelin/wizard@<= 0.10.10 (fixed: 0.10.11)"],"affectedPackageNames":["@openzeppelin/wizard-stylus","@openzeppelin/wizard-stellar","@openzeppelin/wizard-cairo","@openzeppelin/wizard"],"affectedPackageRefs":["npm:@openzeppelin/wizard","npm:@openzeppelin/wizard-cairo","npm:@openzeppelin/wizard-stellar","npm:@openzeppelin/wizard-stylus"],"affectedVendors":["OpenAI"],"affectedVendorsRaw":["OpenZeppelin Contracts Wizard","MCP agent","AI assistant"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-9wxg-vf3r-56hc"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-19T17:45:15.000Z","fixReleasedAt":"2026-06-18T15:26:30.027Z","daysToFix":-1,"fixCheckedAt":"2026-10-29T21:34:12.557Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@openzeppelin/wizard-stylus","fixedVersion":"0.3.1","matchedVersion":"0.3.1","fixReleasedAt":"2026-06-18T15:26:30.027Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:12.404Z"},{"ecosystem":"npm","name":"@openzeppelin/wizard","fixedVersion":"0.10.11","matchedVersion":"0.10.11","fixReleasedAt":"2026-06-18T15:26:32.468Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:12.404Z"},{"ecosystem":"npm","name":"@openzeppelin/wizard-cairo","fixedVersion":"3.0.1","matchedVersion":"3.0.1","fixReleasedAt":"2026-06-18T15:26:30.027Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:12.404Z"},{"ecosystem":"npm","name":"@openzeppelin/wizard-stellar","fixedVersion":"0.6.2","matchedVersion":"0.6.2","fixReleasedAt":"2026-06-18T15:26:30.038Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:12.404Z"}]}}