CVE-2026-114116 Details
Description
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.
A vulnerability exists in Vyper versions 0.1.0b1 prior to 0.1.0b17 and 0.4.1 through 0.5.0b1. The issue arises because these versions construct the source-line table using str.splitlines(), which incorrectly interprets certain characters, such as form feed and U+2028, as line breaks. This misinterpretation allows an attacker to introduce these characters into comments, strings, or indentation, thereby shifting the source text and altering the classification and validation of numeric literals. As a result, address, integer, or decimal constants can be silently changed without any compiler warning.
Users are advised to update to Vyper version 0.1.0b17 or later. For versions 0.4.1 through 0.5.0b1, a fix is not yet available, but users can reject the eight triggering characters in source files before compilation. Affected contracts that have already been deployed should be assessed and, if necessary, recompiled and redeployed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-manipulation-via-line-separators | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vyper | >= 0.1.0b1, < 0.1.0b17 >= 0.4.1, <= 0.5.0b1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |