GHSA-9wxg-vf3r-56hc: OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

Summary

The OpenZeppelin Contracts Wizard generators printed info.securityContact and info.license into a single-line comment in generated Solidity, Cairo, Stellar/Soroban and Stylus source without rejecting line terminators. A newline (\n or \r\n) in either field ends the comment, letting arbitrary declarations be injected into the generated contract. The impact is integrity-only and matters only when these fields are filled from untrusted input, such as an MCP agent whose tool arguments derive from processed content.

Mitigation

Fixed by rejecting line terminators in setInfo, the single code path all surfaces use. Upgrade to the patched versions. @openzeppelin/wizard-confidential and @openzeppelin/wizard-uniswap-hooks receive the fix once their @openzeppelin/wizard dependency is updated to a patched version.

Related items

• MediumCVE-2026-111372: AI ChatBot for WooCommerce WoowBot plugin authorization bypass in RAG syncSame vendor · NVD/CVE Database
• HighCVE-2026-107685: req_llm WebSocket streaming client accepts untrusted TLS certificatesSame vendor · NVD/CVE Database
• MediumCVE-2026-113459: TYPO3 OpenAI API key exposed to backend users in page sourceSame vendor · NVD/CVE Database
• MediumCVE-2026-109296: Open WebUI missing authorization lets users reach disabled model backendsSame vendor · NVD/CVE Database
• MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database