What is the CVSS score of CVE-2026-57583?

CVE-2026-57583 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-57583?

Yes, a patch is available for CVE-2026-57583. Update the affected software to the latest version immediately.

Contracts Wizard CVE-2026-57583

EUVD-2026-77702 LOW

Code Injection (CWE-94)

2026-09-14 GitHub_M

RCE Code Injection Contracts Wizard Wizard Wizard Cairo Wizard Stellar Wizard Stylus

3.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Sep 15, 2026 - 11:35 vuln.today

Analysis Generated

Sep 15, 2026 - 11:35 vuln.today

Patch available

Sep 14, 2026 - 19:03 EUVD

DescriptionCVE.org

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.

AnalysisAI

Comment-injection in the OpenZeppelin Contracts Wizard code generators lets a newline character embedded in the info.securityContact or info.license option break out of the single-line // comment and be emitted as live source declarations in generated Solidity, Cairo, Stellar/Soroban, and Stylus contracts. Only integrations that populate those two fields from untrusted input and then hand the generated source to a downstream consumer are affected — the self-service web app, AI assistant, CLI, and self-hosted API all use user-supplied values and never cross that trust boundary, and shared links cannot set the fields. …