Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-114116Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators

Medium 5.3

In plain English

A medium-severity security flaw in vyper from vyperlang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 82.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.

Affected products (as reported)

Vendor	Product	Versions
vyperlang	vyper	0.1.0b1 – before 0.1.0b17
vyperlang	vyper	0.4.1 – through 0.5.0b1

Weakness: CWE-436 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-wvx7-39qj-2g9v) vendor-advisory
VulnCheck Advisory: Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators third-party-advisory