Quick answers
- Is CVE-2020-37286 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-37286 being exploited in the wild.
- How severe is CVE-2020-37286?
- Medium severity, with a CVSS score of 6.5, published 21 October 2026.
- Which products and versions are affected?
- Vyper 0.1.0b4 to 0.2.x.
- Is there a fix for CVE-2020-37286?
- Yes: fixed in 0.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-37286 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2020-37286?
- Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.3.0
Technical details
The vulnerability is caused by an incorrect stack pointer when internal function calls are nested or used as arguments within tuples or other function calls. This affects internal calls nested in expressions, calls used as arguments to external functions or builtins like concat and ecrecover, and subscripted calls. The flaw results in memory corruption that leads to corrupted return values or wrong arguments being passed to external calls, and is fixed by the new internal calling convention in version 0.3.0.
Affected products
- Vyper Vyper 0.1.0b4 to 0.2.x
Timeline
- 2020-10-10: disclosed
- 2020: patched: Partial fixes in v0.2.6 (yanked), v0.2.7, v0.2.12, v0.2.16; complete fix in v0.3.0