CVE-2026-114114GHSA-r3c7-7xwm-6vfw
Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters
vyperlang vyper
CVSS
6.0MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.
Text from CVE List
Affected versions 5
- vyperaffected: 0.1.0b1 before 0.1.0b12CVE List
- vyperunaffected: 0.1.0b12CVE List
- vyperaffected: 0.1.0b14 before 0.1.0b15CVE List
- vyperunaffected: 0.1.0b15CVE List
- vyperaffected: 0.4.1 through 0.5.0b1CVE List