Vulnerability Description
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v
- https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-manipul
- https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v
FAQ
What is CVE-2026-114116?
CVE-2026-114116 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, ...
How severe is CVE-2026-114116?
CVE-2026-114116 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114116?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.