high8.4
CVE-2026-114663
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in …
Impact
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
Affected products
| Product | Affected versions |
|---|---|
| Vyper 0.4.0b1 | through 0.5.0b1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.