CVE-2026-114116
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Oct 21, 2026
CISA due date
—
The record
Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-61789 DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. CWE-436
- CVE-2026-119200 Nuxt is an open-source web development framework for Vue.js. CWE-436
- CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-436
- CVE-2026-116266 MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart… CWE-436
- CVE-2026-116272 MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary… CWE-436
- CVE-2026-116269 MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a… CWE-436
- CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type… CWE-436
- CVE-2026-116265 MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart… CWE-436