CVE-2026-114116

Published: Ott 21, 2026 Last Modified: Ott 21, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,0
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none

Description

AI Translation Available

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

436

Interpretation Conflict

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Other
Potential Impacts:
Unexpected State Varies By Context
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/vyperlang/vyper/security/advisories/GHSA…
https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v
https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-…
https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-manipu…