Nixpkgs security tracker
3.3 LOW
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Prior to @openzeppelin/wizard 0.10.11, @openzeppelin/wizard-cairo 3.0.1, @openzeppelin/wizard-stellar 0.6.2, and @openzeppelin/wizard-stylus 0.3.1, the setInfo code path prints info.securityContact and info.license verbatim into single-line comments in generated Solidity, Cairo, Stellar/Soroban, and Stylus source. A line terminator ends the comment and causes following input to be emitted as source declarations. Exploitation requires an integration to populate these fields from untrusted input and a user to consume the generated source; normal self-service web, AI assistant, CLI, and self-hosted API use does not cross that trust boundary, shared links cannot set the fields, and no code executes on a Wizard service. This issue affects generated-source integrity only and is fixed in versions 0.10.11, 3.0.1, 0.6.2, and 0.3.1 of the respective packages.
References
-
https://github.com/OpenZeppelin/contracts-wizard/pull/818 x_refsource_MISC
Affected products
- ==< 0.10.11
- ==< 3.0.1
- ==< 0.3.1
- ==< 0.6.2
- ==< 0.10.11
Matching in nixpkgs
pkgs.mutt-wizard
System for automatically configuring mutt and isync
pkgs.wheelwizard
WheelWizard, Retro Rewind Launcher
pkgs.cargo-wizard
Cargo subcommand for configuring Cargo profile for best performance
pkgs.roomeqwizard
Room Acoustics Software
pkgs.dataclass-wizard
Wizarding tools for interacting with the Python dataclasses module
pkgs.dn42-registry-wizard
Collection of tools to interact with DN42 registry data
pkgs.haskellPackages.wizard
the fantastical wizard monoid
pkgs.haskellPackages.wizards
High level, generic library for interrogative user interfaces
pkgs.tmuxPlugins.session-wizard
Tmux plugin for creating and switching between sessions based on recently accessed directories
pkgs.gnomeExtensions.app-grid-wizard
A gnome shell extension that simplifies organizing your applications into predefined categories in the app grid.
pkgs.kdePackages.kmail-account-wizard
Application which assists you with the configuration of accounts in KMail
pkgs.kdePackages.akonadi-import-wizard
Assistant to import external PIM data into Akonadi for use in KDE PIM apps
pkgs.python313Packages.dataclass-wizard
Wizarding tools for interacting with the Python dataclasses module
pkgs.python314Packages.dataclass-wizard
Wizarding tools for interacting with the Python dataclasses module
pkgs.python313Packages.python-homewizard-energy
Library to communicate with HomeWizard Energy devices
Package maintainers
-
@iamanaws Angel J <iamanaws@httpd.dev>
-
@codifryed Guy Boldon <gb@guyboldon.com>
-
@Defelo Defelo
-
@honnip Jung seungwoo <me@honnip.page>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@FRidh Frederik Rietdijk <fridh@fridh.nl>
-
@K900 Ilya K. <me@0upti.me>
-
@mjm Matt Moriarity <matt@mattmoriarity.com>
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
-
@bkchr Bastian Köcher <nixos@kchr.de>
-
@peterhoeg Peter Hoeg <peter@hoeg.com>
-
@nyanloutre Paul Trehiou <paul@nyanlout.re>
-
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
-
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@zaninime Francesco Zanini <francesco@zanini.me>
-
@mandos Marek Maksimczyk <marek.maksimczyk@mandos.net.pl>
-
@DerHalbGrieche Vasilis Manetas <vasilis12.manetas@gmail.com>