---
id: CVE-2026-114116
title: Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators
summary: >-
  Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line
  table with str.splitlines(), which treats characters like form feed and U+2028
  as line breaks the Python parser ignores, so numeric literals are classified
  an…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-436
vendor: vyperlang
product: vyper
affected:
  - vyper >= 0.1.0b1 < 0.1.0b17
  - vyper >= 0.4.1 <= 0.5.0b1
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:37:13.988Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114116'
references:
  - url: 'https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v'
    label: GitHub Security Advisory (GHSA-wvx7-39qj-2g9v)
  - url: >-
      https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-manipulation-via-line-separators
    label: >-
      VulnCheck Advisory: Vyper through 0.5.0b1 Literal Value Manipulation via
      Line Separators
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.009Z'
---

## Overview

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

## Affected

- `vyper >= 0.1.0b1 < 0.1.0b17`
- `vyper >= 0.4.1 <= 0.5.0b1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.