---
id: "CVE-2026-114116"
kind: "vulnerability"
aliases: ["CVE-2026-114116"]
title: "Vyper: line-break characters let attackers silently change contract constants"
severity: "medium"
cvss: 6.0
epss: 0.00183
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ethereum", "package", "python", "smart-contracts", "vyper"]
not_affected_if: ["own-reviewed-source-only", "patched-version"]
published_at: "2026-10-21T01:17:37+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:05:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114116", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114116", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Vyper: line-break characters let attackers silently change contract constants

Vyper builds its source-line table with str.splitlines(), which treats form feed and U+2028 as line breaks that Python's parser ignores, so numeric literals are read from shifted text. An attacker who contributes source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Vyper version with `vyper --version` or `pip show vyper`
- Review contract source from untrusted contributors for form feed (\f) or U+2028 characters in comments, strings or indentation

## Fix

- Upgrade Vyper to `0.1.0b17` or later on the 0.1.x line, or to a fixed release on the 0.4.x and 0.5.0 line (exact fixed version unknown from the sources)

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114116
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114116

## From the sources

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_