vyper (PyPI)
Advisories
87
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.4.1 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "vyper>=0.4.1"poetry
poetry add "vyper>=0.4.1"uv
uv add "vyper>=0.4.1"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-2r3x-4mrv-mcxf Vyper: Memory corruption using function calls within tuples / nested calls |
Medium EPSS 0.28% |
< 0.2.6 | 0.2.6 |
| GHSA-4v7v-gqf9-ww2g Vyper: Call stack corruption when passing complex type containing non-base type members as argument |
Medium EPSS 0.25% |
< 0.2.6 | 0.2.6 |
| GHSA-vg88-3v92-rjx2 Vyper: Return inside for loop more than 1 level deep |
Low EPSS 0.35% |
>= 0.1.0b10, < 0.2.3 | 0.2.3 |
| GHSA-3vcg-j39x-cwfm Vyper's `slice()` may elide side-effects when output length is 0 |
Low EPSS 0.48% |
<= 0.4.2rc1 | No fix yet |
| GHSA-3vcg-j39x-cwfm Vyper's `slice()` may elide side-effects when output length is 0 |
Low EPSS 0.48% |
<= 0.4.2rc1 | No fix yet |
| GHSA-qhr6-mgqr-mchm Vyper's `concat()` builtin may elide side-effects for zero-length arguments |
Low EPSS 0.46% |
<= 0.4.2rc1 | No fix yet |
| GHSA-qhr6-mgqr-mchm Vyper's `concat()` builtin may elide side-effects for zero-length arguments |
Low EPSS 0.46% |
<= 0.4.2rc1 | No fix yet |
| GHSA-2p94-8669-xg86 Vyper's sqrt doesn't define rounding behavior |
High EPSS 0.33% |
< 0.4.1 | 0.4.1 |
| GHSA-h33q-mhmp-8p67 Vyper has a double eval in For List Iter |
High EPSS 0.45% |
< 0.4.1 | 0.4.1 |
| GHSA-h33q-mhmp-8p67 Vyper has a double eval in For List Iter |
High EPSS 0.45% |
< 0.4.1 | 0.4.1 |
| GHSA-4w26-8p97-f4jp AugAssign evaluation order causing OOB write within the object in Vyper |
Critical EPSS 0.57% |
< 0.4.1 | 0.4.1 |
| GHSA-4w26-8p97-f4jp AugAssign evaluation order causing OOB write within the object in Vyper |
Critical EPSS 0.57% |
< 0.4.1 | 0.4.1 |
| GHSA-2p94-8669-xg86 Vyper's sqrt doesn't define rounding behavior |
High EPSS 0.33% |
< 0.4.1 | 0.4.1 |
| GHSA-vgf2-gvx8-xwc3 Vyper Does Not Check the Success of Certain Precompile Calls |
High EPSS 0.67% |
< 0.4.1 | 0.4.1 |
| GHSA-vgf2-gvx8-xwc3 Vyper Does Not Check the Success of Certain Precompile Calls |
High EPSS 0.67% |
all versions | No fix yet |
| GHSA-5jrj-52x8-m64h vyper performs multiple eval of `sqrt()` argument built in |
Medium EPSS 0.46% |
< 0.4.0 | 0.4.0 |
| GHSA-m2v9-w374-5hj9 vyper default functions don't respect nonreentrancy keys |
Medium EPSS 0.41% |
< 0.3.0 | 0.3.0 |
| GHSA-m2v9-w374-5hj9 vyper default functions don't respect nonreentrancy keys |
Medium EPSS 0.41% |
< 0.3.0 | 0.3.0 |
| GHSA-5jrj-52x8-m64h vyper performs multiple eval of `sqrt()` argument built in |
Medium EPSS 0.46% |
< 0.4.0 | 0.4.0 |
| GHSA-3whq-64q2-qfj6 vyper performs double eval of raw_args in create_from_blueprint |
Medium EPSS 0.46% |
< 0.4.0 | 0.4.0 |
| GHSA-xchq-w5r3-4wg3 vyper performs incorrect topic logging in raw_log |
Medium EPSS 0.46% |
< 0.4.0 | 0.4.0 |
| GHSA-xchq-w5r3-4wg3 vyper performs incorrect topic logging in raw_log |
Medium EPSS 0.46% |
< 0.4.0 | 0.4.0 |
| GHSA-r56x-j438-vw5m vyper performs double eval of the slice start/length args in certain cases |
Medium EPSS 0.46% |
< 0.4.0 | 0.4.0 |
| GHSA-r56x-j438-vw5m vyper performs double eval of the slice start/length args in certain cases |
Medium EPSS 0.46% |
< 0.4.0 | 0.4.0 |
| GHSA-3whq-64q2-qfj6 vyper performs double eval of raw_args in create_from_blueprint |
Medium EPSS 0.46% |
< 0.4.0 | 0.4.0 |
| GHSA-ppx5-q359-pvwj vyper's range(start, start + N) reverts for negative numbers |
Medium EPSS 0.80% |
>= 0.3.8, < 0.4.0b1 | 0.4.0b1 |
| GHSA-ppx5-q359-pvwj vyper's range(start, start + N) reverts for negative numbers |
Medium EPSS 0.80% |
>= 0.3.8, < 0.4.0 | 0.4.0 |
| GHSA-4hwq-4cpm-8vmx Vyper's `extract32` can ready dirty memory |
Medium EPSS 0.56% |
< 0.4.0 | 0.4.0 |
| GHSA-4hwq-4cpm-8vmx Vyper's `extract32` can ready dirty memory |
Medium EPSS 0.56% |
< 0.4.0 | 0.4.0 |
| GHSA-9p8r-4xp4-gw5w Vyper's `_abi_decode` vulnerable to Memory Overflow |
Medium EPSS 0.55% |
< 0.4.0 | 0.4.0 |
| GHSA-9p8r-4xp4-gw5w Vyper's `_abi_decode` vulnerable to Memory Overflow |
Medium EPSS 0.55% |
< 0.4.0b1 | 0.4.0b1 |
| GHSA-52xq-j7v9-v4v2 Vyper negative array index bounds checks |
Critical EPSS 1.54% |
< 0.4.0b1 | 0.4.0b1 |
| GHSA-52xq-j7v9-v4v2 Vyper negative array index bounds checks |
Critical EPSS 1.54% |
< 0.4.0 | 0.4.0 |
| GHSA-6845-xw22-ffxv Vyper sha3 codegen bug |
Medium EPSS 0.26% |
< 0.4.0 | 0.4.0 |
| GHSA-6845-xw22-ffxv Vyper sha3 codegen bug |
Medium EPSS 0.26% |
< 0.4.0b1 | 0.4.0b1 |
| GHSA-gp3w-2v2m-p686 Vyper's external calls can overflow return data to return input buffer |
Medium EPSS 0.53% |
< 0.4.0b1 | 0.4.0b1 |
| GHSA-gp3w-2v2m-p686 Vyper's external calls can overflow return data to return input buffer |
Medium EPSS 0.53% |
< 0.4.0 | 0.4.0 |
| GHSA-9x7f-gwxq-6f2c Vyper's bounds check on built-in `slice()` function can be overflowed |
Critical EPSS 0.90% |
< 0.4.0b1 | 0.4.0b1 |
| GHSA-9x7f-gwxq-6f2c Vyper's bounds check on built-in `slice()` function can be overflowed |
Critical EPSS 0.90% |
< 0.4.0 | 0.4.0 |
| GHSA-x2c2-q32w-4w6m Vyper's raw_call `value=` kwargs not disabled for static and delegate calls |
Medium EPSS 0.48% |
< 0.4.0b1 | 0.4.0b1 |
| GHSA-x2c2-q32w-4w6m Vyper's raw_call `value=` kwargs not disabled for static and delegate calls |
Medium EPSS 0.48% |
< 0.4.0 | 0.4.0 |
| GHSA-2q8v-3gqq-4f8p concat built-in can corrupt memory in vyper |
Critical EPSS 0.77% |
< 0.4.0b1 | 0.4.0b1 |
| GHSA-2q8v-3gqq-4f8p concat built-in can corrupt memory in vyper |
Critical EPSS 0.77% |
>= 0.3.0, < 0.4.0 | 0.4.0 |
| GHSA-6m97-7527-mh74 incorrect storage layout for contracts containing large arrays |
High EPSS 0.69% |
< 0.3.8 | 0.3.8 |
| GHSA-6m97-7527-mh74 incorrect storage layout for contracts containing large arrays |
High EPSS 0.69% |
< 0.3.8 | 0.3.8 |
| GHSA-cx2q-hfxr-rj97 Vyper's `_abi_decode` input not validated in complex expressions |
High EPSS 0.67% |
>= 0.3.4, < 0.3.10 | 0.3.10 |
| GHSA-cx2q-hfxr-rj97 Vyper's `_abi_decode` input not validated in complex expressions |
High EPSS 0.67% |
>= 0.3.4, < 0.3.10 | 0.3.10 |
| GHSA-c647-pxm2-c52w Vyper vulnerable to memory corruption in certain builtins utilizing `msize` |
High EPSS 0.83% |
>= 0.3.4, < 0.3.10 | 0.3.10 |
| GHSA-c647-pxm2-c52w Vyper vulnerable to memory corruption in certain builtins utilizing `msize` |
High EPSS 0.83% |
< 0.3.10 | 0.3.10 |
| GHSA-3hg2-r75x-g69m Vyper has incorrect re-entrancy lock when key is empty string |
Medium EPSS 0.51% |
>= 0.2.9, < 0.3.10 | 0.3.10 |
| GHSA-3hg2-r75x-g69m Vyper has incorrect re-entrancy lock when key is empty string |
Medium EPSS 0.51% |
>= 0.2.9, < 0.3.10 | 0.3.10 |
| GHSA-4hg4-9mf5-wxxq incorrect order of evaluation of side effects for some builtins |
Medium EPSS 0.54% |
< 0.3.10rc1 | 0.3.10rc1 |
| GHSA-4hg4-9mf5-wxxq incorrect order of evaluation of side effects for some builtins |
Medium EPSS 0.54% |
< 0.3.10 | 0.3.10 |
| GHSA-g2xh-c426-v8mf Vyper: reversed order of side effects for some operations |
Medium EPSS 0.49% |
< 0.3.10rc1 | 0.3.10rc1 |
| GHSA-g2xh-c426-v8mf Vyper: reversed order of side effects for some operations |
Medium EPSS 0.49% |
<= 0.4.2 | No fix yet |
| GHSA-5824-cm3x-3c38 Vyper has incorrectly allocated named re-entrancy locks |
High EPSS 0.82% |
>= 0.2.15, < 0.3.1 | 0.3.1 |
| GHSA-5824-cm3x-3c38 Vyper has incorrectly allocated named re-entrancy locks |
High EPSS 0.82% |
all versions | No fix yet |
| GHSA-f5x6-7qgp-jhf3 ecrecover can return undefined data if signature does not verify |
Medium EPSS 0.57% |
< 0.3.10 | 0.3.10 |
| GHSA-f5x6-7qgp-jhf3 ecrecover can return undefined data if signature does not verify |
Medium EPSS 0.57% |
< 0.3.9 | 0.3.9 |
| GHSA-vxmm-cwh2-q762 Vyper's nonpayable default functions are sometimes payable |
Low EPSS 0.55% |
< 0.3.8 | 0.3.8 |
| GHSA-vxmm-cwh2-q762 Vyper's nonpayable default functions are sometimes payable |
Low EPSS 0.55% |
< 0.3.8 | 0.3.8 |
| GHSA-ph9x-4vc9-m39g Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls |
High EPSS 0.73% |
< 0.3.8 | 0.3.8 |
| GHSA-ph9x-4vc9-m39g Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls |
High EPSS 0.73% |
< 0.3.8 | 0.3.8 |
| GHSA-3p37-3636-q8wv Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment |
High EPSS 1.25% |
< 0.3.8 | 0.3.8 |
| GHSA-6r8q-pfpv-7cgj Vyper vulnerable to integer overflow in loop |
High EPSS 0.91% |
< 0.3.8 | 0.3.8 |
| GHSA-6r8q-pfpv-7cgj Vyper vulnerable to integer overflow in loop |
High EPSS 0.91% |
< 0.3.8 | 0.3.8 |
| GHSA-3p37-3636-q8wv Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment |
High EPSS 1.25% |
< 0.3.8 | 0.3.8 |
| GHSA-mgv8-gggw-mrg6 vyper vulnerable to storage allocator overflow |
High EPSS 0.70% |
< 0.3.8 | 0.3.8 |
| GHSA-mgv8-gggw-mrg6 vyper vulnerable to storage allocator overflow |
High EPSS 0.70% |
< 0.3.8 | 0.3.8 |
| GHSA-w9g2-3w7p-72g9 Incorrect success value returned in vyper |
High EPSS 0.88% |
>= 0.3.1, < 0.3.8 | 0.3.8 |
| GHSA-w9g2-3w7p-72g9 Incorrect success value returned in vyper |
High EPSS 0.88% |
>= 0.3.1, < 0.3.8 | 0.3.8 |
| GHSA-4v9q-cgpw-cf38 Multiple evaluation of contract address in call in vyper |
High EPSS 1.35% |
< 0.3.4 | 0.3.4 |
| GHSA-4v9q-cgpw-cf38 Multiple evaluation of contract address in call in vyper |
High EPSS 1.35% |
< 0.3.4 | 0.3.4 |
| GHSA-j2x6-9323-fp7h Integer bounds error in Vyper |
High EPSS 1.43% |
< 0.3.2 | 0.3.2 |
| GHSA-j2x6-9323-fp7h Integer bounds error in Vyper |
High EPSS 1.43% |
< 0.3.2 | 0.3.2 |
| GHSA-4mrx-6fxm-8jpg Buffer Overflow in vyper |
High EPSS 0.99% |
< 0.3.2 | 0.3.2 |
| GHSA-4mrx-6fxm-8jpg Buffer Overflow in vyper |
High EPSS 0.99% |
< 0.3.2 | 0.3.2 |
| GHSA-7vrm-3jc8-5wwm Incorrect Comparison in Vyper |
High EPSS 1.03% |
< 0.3.2 | 0.3.2 |
| GHSA-7vrm-3jc8-5wwm Incorrect Comparison in Vyper |
High EPSS 1.03% |
< 0.3.2 | 0.3.2 |
| GHSA-xv8x-pr4h-73jv Memory corruption when returning a literal struct with a private call inside of it |
High EPSS 1.07% |
< 0.3.0 | 0.3.0 |
| GHSA-xv8x-pr4h-73jv Memory corruption when returning a literal struct with a private call inside of it |
High EPSS 1.07% |
< 0.3.0 | 0.3.0 |
| GHSA-c7pr-343r-5c46 missing clamps for decimal args in external functions |
Medium EPSS 0.80% |
< 0.3.0 | 0.3.0 |
| GHSA-c7pr-343r-5c46 missing clamps for decimal args in external functions |
Medium EPSS 0.80% |
< 0.3.0 | 0.3.0 |
| GHSA-7f92-rr6w-cq64 Storage corruption due to variables overwritten by re-entrancy locks |
High EPSS 0.39% |
>= 0.2.13, < 0.2.15 | 0.2.15 |
| GHSA-22wc-c9wj-6q2v VVE-2021-0001: Memory corruption using function calls within arrays |
High EPSS 0.28% |
< 0.2.12 | 0.2.12 |
| GHSA-375m-5fvv-xq23 VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption |
Medium EPSS 0.25% |
< 0.2.9 | 0.2.9 |
| GHSA-mr6r-mvw4-736g Vyper interfaces returning integer types less than 256 bits can be manipulated if uint256 is used |
Medium EPSS 0.26% |
<= 0.1.0b16 | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor