High severity · published May 11, 2023
CVE-2023-32059
Vyper is a Pythonic smart contract language for the Ethereum virtual machine
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VY
Vyper · Vyperlang
before 0.3.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32059
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32059
Patch
https://github.com/vyperlang/vyper/commit/c3e68c302aa6e1429946473769dd1232145822ac
Exploit
https://github.com/vyperlang/vyper/security/advisories/GHSA-ph9x-4vc9-m39g
More from Vyper
9.8
CVE-2024-24563
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2024-24561
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2024-22419
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2022-24845
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2022-24788
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
