What’s Vulnerable › Vulnerabilities

CVE-2026-114116: Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-28
• Weakness: CWE-436

Description

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

Affected products

• vyperlang vyper: from 0.1.0b1 before 0.1.0b17 — fixed in 0.1.0b17

How to fix

Upgrade to a fixed version: vyperlang vyper 0.1.0b17. Check the vendor advisory for mitigations.

References

• https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v
• https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-manipulation-via-line-separators
• https://github.com/vyperlang/vyper/security/advisories/GHSA-wvx7-39qj-2g9v

Get alerted when CVE-2026-114116 or the next vulnerability affects your stack