All vulnerabilities
CVE-2026-114116GHSA-wvx7-39qj-2g9v

Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators

vyperlang vyper
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.1.0b17Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

Text from CVE List

Affected versions 3

  • vyperaffected: 0.1.0b1 before 0.1.0b17CVE List
  • vyperunaffected: 0.1.0b17CVE List
  • vyperaffected: 0.4.1 through 0.5.0b1CVE List

References 2