CVE-2026-114116Medium· 5.3▾ SunlitVyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified an…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.
vyper >= 0.1.0b1 < 0.1.0b17vyper >= 0.4.1 <= 0.5.0b1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2020-37288Low· 3.7Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops
CVE-2020-37286Medium· 6.5Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls
CVE-2020-37289Low· 3.7Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values
CVE-2020-37287Medium· 5.9Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments
CVE-2021-48018High· 7.4Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator
CVE-2021-48019Medium· 4.8Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies