OpenZeppelin Contracts Wizard is a web application that builds smart contracts by accepting user inputs. In versions prior to 0.10.9 the wizard incorporates the raw user‑supplied opts.name and opts.uri fields directly into TypeScript string literals when generating Hardhat test files. Because these inputs are not escaped, an attacker can craft a malicious URL that injects arbitrary Node.js code into the resulting test file. When a developer downloads the zip archive and runs the test suite the injected code executes with the developer’s local OS privileges, enabling arbitrary command execution and full compromise of the development machine. This vulnerability is a classic code injection (CWE‑94).

OpenZeppelin Contracts Wizard, deployed as a web application by OpenZeppelin, is the affected product. All releases prior to version 0.10.9 carry this flaw. The vulnerability is triggered by unescaped user inputs during test file generation, irrespective of the contract type chosen (ERC20, ERC721, ERC1155). Developers who use earlier releases and download the generated test archives are at risk. Updating to 0.10.9 or later removes the code injection path.

The CVSS score of 8.8 classifies the issue as high severity, reflecting the potential for remote code execution with local system privileges. Because the wizard is publicly accessible without authentication, an attacker can construct a malicious URL that embeds arbitrary Node.js code and easily distribute it to unsuspecting developers. When the victim runs the included test file, the code executes as the invoking user. Though the EPSS score is not available, the open‑browser nature of the application suggests a high likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but the ease of creating and sharing the exploit raises concern for widespread, low‑cost attack activity.