CVE-2023-32059 json
Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls
published 2023-05-11 3 y ago modified 2026-09-10 1 mo ago also GHSA-ph9x-4vc9-m39g , PYSEC-2023-79 , EUVD-2023-0272
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/vyperlang/vyper/security/advisories/GHSA-ph9x-4vc9-m39g referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | vyper | <0.3.8 |
0.3.8 |
Affected products
- vyperlang vyper
Classification
- Weakness
-
- CWE-683 Function Call With Incorrect Order of Arguments
References
-
github.com
/vyperlang/vyper/commit/c3e68c302aa6e1429946473769dd1232145822ac
web, patch
-
github.com
/vyperlang/vyper/security/advisories/GHSA-ph9x-4vc9-m39g
web, exploit, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-32059
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-79.yaml
web
-
github.com
/vyperlang/vyper
package
Sources
- CVE List CVE-2023-32059
- GitHub Advisory GHSA-ph9x-4vc9-m39g
- NVD CVE-2023-32059
- OSV PYSEC-2023-79
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.