{"id":"CVE-2026-114116","kind":"vulnerability","aliases":["CVE-2026-114116"],"related":[],"title":"Vyper: line-break characters let attackers silently change contract constants","description":"Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.","summary":"Vyper builds its source-line table with str.splitlines(), which treats form feed and U+2028 as line breaks that Python's parser ignores, so numeric literals are read from shifted text. An attacker who contributes source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.","severity":"medium","cvss":6.0,"epss":0.00183,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ethereum","package","python","smart-contracts","vyper"],"not_affected_if":["own-reviewed-source-only","patched-version"],"how_to_check":"- Check the installed Vyper version with `vyper --version` or `pip show vyper`\n- Review contract source from untrusted contributors for form feed (\\f) or U+2028 characters in comments, strings or indentation","fix":"- Upgrade Vyper to `0.1.0b17` or later on the 0.1.x line, or to a fixed release on the 0.4.x and 0.5.0 line (exact fixed version unknown from the sources)","status":"open","published_at":"2026-10-21T01:17:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:05:31+00:00","updated_at":"2026-10-25T04:05:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:05:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vyper to `0.1.0b17` or later on the 0.1.x line, or to a fixed release on the 0.4.x and 0.5.0 line (exact fixed version unknown from the sources)","reach":"local","title":"Vyper: line-break characters let attackers silently change contract constants","impact":"medium","summary":"Vyper builds its source-line table with str.splitlines(), which treats form feed and U+2028 as line breaks that Python's parser ignores, so numeric literals are read from shifted text. An attacker who contributes source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.","category":"package","nicknames":[],"who_cares":["vyper","smart-contracts","python","ethereum"],"confidence":0.6,"needs_auth":"no","worst_case":"Contract constants like addresses or amounts silently change at compile time","analyst_note":"Confirm the fixed version for the 0.4.x and 0.5.0 line from the NVD record or the Vyper release notes; sources give only 0.1.0b17 as a fix point.","how_to_check":"- Check the installed Vyper version with `vyper --version` or `pip show vyper`\n- Review contract source from untrusted contributors for form feed (\\f) or U+2028 characters in comments, strings or indentation","needs_analyst":true,"not_affected_if":["patched-version","own-reviewed-source-only"],"who_is_affected":"Teams that compile Vyper contracts from source they do not fully control, such as external pull requests or third-party code, are the exposed case, because the hidden characters must come from the source. Teams that compile only their own reviewed code on a patched Vyper version can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000652,"input_tokens":3424,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'+2028':40B,107C '-114116':14A,17A '-2026':13A,16A '0.1.0':81C,84C '0.4.1':87C '0.5.0':89C 'address':75B,143C 'attack':7A,58B,127C 'b1':82C,90C 'b17':85C 'break':4A,43B,110C 'build':26B,91C 'chang':9A,74B,142C 'charact':5A,66B,101C,134C 'classifi':119C 'code':62B,130C 'comment':68B,136C 'constant':11A,79B,147C 'contract':10A,23B 'contribut':60B,128C 'cve':12A,15A 'decim':78B,146C 'ethereum':18B 'feed':37B,104C 'form':36B,103C 'hide':64B,132C 'ignor':48B,114C 'indent':71B,139C 'integ':76B,144C 'let':6A 'like':102C 'line':3A,30B,42B,95C,109C 'line-break':2A 'liter':51B,117C 'numer':50B,116C 'packag':19B 'parser':47B,113C 'python':20B,45B,112C 'read':53B 'shift':55B,123C 'silent':8A,73B,141C 'smart':22B 'smart-contract':21B 'sourc':29B,61B,94C,124C,129C 'source-lin':28B,93C 'str.splitlines':33B,98C 'string':69B,137C 'tabl':31B,96C 'text':56B,125C 'treat':35B,100C 'u':39B,106C 'valid':121C 'vyper':1A,24B,25B,80C","nicknames":[],"mitigations":[],"who_affected":"Teams that compile Vyper contracts from source they do not fully control, such as external pull requests or third-party code, are the exposed case, because the hidden characters must come from the source. Teams that compile only their own reviewed code on a patched Vyper version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114116","severity":null,"published_at":"2026-10-21T01:17:37+00:00","modified_at":"2026-10-22T17:00:33+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114116","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114116","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}