Read the docs
TI-2023-21678 Aliases CVE-2023-41052GHSA-4hg4-9mf5-wxxq

Vyper: incorrect order of evaluation of side effects for some builtins

Priority LOW 25CWE-670Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00536 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vyper (PyPI): 0.3.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vyperlangvyperup to 0.3.9—No fix listedCNA
—vyper (PyPI)before 0.3.100.3.10Patch availableGHSA-4hg4-9mf5-wxxq
  • vyper Vendorvyperlang Affected up to 0.3.9 Fixed in — No fix listed CNA
  • vyper (PyPI) Vendor— Affected before 0.3.10 Fixed in 0.3.10 Patch available GHSA-4hg4-9mf5-wxxq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:python:*:*up to 0.3.9Vulnerablevyperlang
  • cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:python:*:* Versions up to 0.3.9 Vulnerable ·vyperlang

Remediation

  • Fix · GHSA-4hg4-9mf5-wxxq vyper (PyPI) Fixed in 0.3.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-41052
  2. 2026-10-03 Alias added: GHSA-4hg4-9mf5-wxxq

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2024-16182 Vyper bounds check on built-in `slice()` function can be overflowed CVSS 3.1CRITICAL 9.8
  • TI-2024-14992 concat built-in can corrupt memory in vyper CVSS 3.1CRITICAL 9.8
  • TI-2024-16184 Vyper array negative index vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-08657 Integer bounds error in Vyper CVSS 3.1CRITICAL 9.8
  • TI-2022-11796 Multiple evaluation of contract address in call in vyper CVSS 3.1HIGH 8.2
  • TI-2024-21531 vyper performs double eval of the argument of sqrt CVSS 3.1MEDIUM 5.3
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences