CVE-2023-41052 json
Vyper: incorrect order of evaluation of side effects for some builtins
published 2023-09-04 3 y ago modified 2026-09-17 52 d ago also GHSA-4hg4-9mf5-wxxq , PYSEC-2023-168 , EUVD-2023-0267
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
Patch / fix
- pypi vyper 0.3.10, 0.3.10rc1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxq referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | vyper | <0.3.10 <0.3.10rc1 |
0.3.10 0.3.10rc1 |
Affected products
- vyperlang vyper
Classification
- Weakness
-
- CWE-670 Always-Incorrect Control Flow Implementation
References
-
github.com
/vyperlang/vyper/pull/3583
web, patch
-
github.com
/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxq
web, exploit, patch, third-party-advisory, advisory
-
github.com
/vyperlang/vyper/commit/78fa8dd8f91ba0cb26277eeffb585c68c83e7daa
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-41052
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-168.yaml
web
-
github.com
/vyperlang/vyper
package
Sources
- CVE List CVE-2023-41052
- GitHub Advisory GHSA-4hg4-9mf5-wxxq
- NVD CVE-2023-41052
- OSV PYSEC-2023-168
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.