{"id":"CVE-2025-47285","aliases":["GHSA-qhr6-mgqr-mchm","PYSEC-2026-2029"],"title":"Vyper's `concat()` builtin may elide side-effects for zero-length arguments","summary":"Vyper's `concat()` builtin may elide side-effects for zero-length arguments","severity":"low","vendor":"vyper","product":"vyper","ecosystem":"pip","affected":["vyper <= 0.4.2rc1"],"published":"2025-05-16","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-qhr6-mgqr-mchm","references":[{"url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-qhr6-mgqr-mchm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47285"},{"url":"https://github.com/vyperlang/vyper/pull/4644"},{"url":"https://github.com/vyperlang/vyper"},{"url":"https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L560-L562"}],"tags":["osv","pip"],"epss":0.00444,"epssPercentile":0.38022,"ingestedAt":"2026-07-08T18:25:52.437Z","slug":"CVE-2025-47285","body":"## Overview\n\n### Impact\n`concat()` may skip evaluation of side effects when the length of an argument is zero. this is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero:\nhttps://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L560-L562\n\nin practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal `b\"\"`; the only way to construct an empty bytestring which has side effects would be with the ternary operator introduced in v0.3.8, e.g. `b\"\" if self.do_some_side_effect() else b\"\"`.\n\nthe following example demonstrates how the issue would look in user code\n```vyper\ncounter: public(uint256)\n\n@external\ndef test() -> Bytes[256]:\n    a: Bytes[256] = concat(b\"\" if self.sideeffect() else b\"\", b\"aaaa\")\n    return a\n\ndef sideeffect() -> bool:\n    self.counter += 1\n    return True\n```\n\nthe severity assigned is low, since, as mentioned, this would be a very unusual pattern in user-code.\n\n### Patches\n\nfix is tracked in https://github.com/vyperlang/vyper/pull/4644\n\n### Workarounds\ndon't have side effects in expressions which construct zero-length bytestrings.\n\n### References\n_Are there any links users can visit to find out more?_\n\n## Affected packages\n\n- `vyper <= 0.4.2rc1`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}