CERT24CVE-2026-114116 — Vyper through 0.5.0b1: Literal Value Manipulation via Line SeparatorsLoading data…
CERT24Threat Observatory
Period

CVE-2026-114116 — Vyper through 0.5.0b1: Literal Value Manipulation via Line Separators

Vyper versions 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 build their source-line table with str.splitlines(). This treats characters such as form feed and U+2028 as line breaks that the Python parser ignores. As a result, numeric literals may be classified and validated using shifted source text.

← Back to intelligence

CVE-2026-114116 — Vyper through 0.5.0b1: Literal Value Manipulation via Line Separators

Vyper versions 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 build their source-line table with str.splitlines(). This treats characters such as form feed and U+2028 as line breaks that the Python parser ignores. As a result, numeric literals may be classified and validated using shifted source text.