---
id: CVE-2026-114114
title: Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters
summary: >-
  Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix
  character-based line offsets with Python's UTF-8 byte col_offset values in
  vyper/ast/parse.py, so multi-byte characters shift the source slices used to
  reconstruct la…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-176
vendor: vyperlang
product: vyper
affected:
  - vyper >= 0.1.0b1 < 0.1.0b12
  - vyper >= 0.1.0b14 < 0.1.0b15
  - vyper >= 0.4.1 <= 0.5.0b1
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:37:12.518Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114114'
references:
  - url: 'https://github.com/vyperlang/vyper/security/advisories/GHSA-r3c7-7xwm-6vfw'
    label: GitHub Security Advisory (GHSA-r3c7-7xwm-6vfw)
  - url: >-
      https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-substitution-via-multi-byte-characters
    label: >-
      VulnCheck Advisory: Vyper through 0.5.0b1 Literal Value Substitution via
      Multi-byte Characters
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.010Z'
---

## Overview

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.

## Affected

- `vyper >= 0.1.0b1 < 0.1.0b12`
- `vyper >= 0.1.0b14 < 0.1.0b15`
- `vyper >= 0.4.1 <= 0.5.0b1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.