Live › vulnerability › CVE-2026-114116
Go to dashboardVyper builds its source-line table with str.splitlines(), which treats form feed and U+2028 as line breaks that Python's parser ignores, so numeric literals are read from shifted text. An attacker who contributes source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that compile Vyper contracts from source they do not fully control, such as external pull requests or third-party code, are the exposed case, because the hidden characters must come from the source. Teams that compile only their own reviewed code on a patched Vyper version can skip it.
No product ranges from the sources yet.
vyper --version or pip show vyper0.1.0b17 or later on the 0.1.x line, or to a fixed release on the 0.4.x and 0.5.0 line (exact fixed version unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.
This page as .md · .json · in your agent: get_signal("CVE-2026-114116")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.