CVE-2026-114116
Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators
- State
- Published
- Severity
- 6.0 Medium
- Published
- Oct 21, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 20, 2026
Description
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.0 Medium | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-436 Interpretation Conflict
Affected Products
| Product | Versions |
|---|---|
vypervyperlang |
|
vypervyperlang |
|
References
- GitHub Security Advisory (GHSA-wvx7-39qj-2g9v)vendor-advisory
- VulnCheck Advisory: Vyper through 0.5.0b1 Literal Value Manipulation via Line Separatorsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.