Is CVE-2021-48018 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-48018 being exploited in the wild.

How severe is CVE-2021-48018?

High severity, with a CVSS score of 7.4, published 21 October 2026.

Is there a fix for CVE-2021-48018?

Yes: fixed in 0.2.15. Until then: Do not use the @nonreentrant decorator in versions 0.2.13 through 0.2.14; upgrade to version 0.2.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-48018 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-48018?

Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-48018: Vyper storage variable corruption via @nonreentrant decorator

CVE-2021-48018 · Severity: high · CVSS 7.4 · Published 2026-10-21

Vyper, a programming language used to write smart contracts, has a critical flaw in versions 0.2.13 through 0.2.14 where the reentrancy protection decorator overwrites contract storage variables. This corruption breaks the contract's logic and could allow attackers to exploit the affected smart contracts for theft or unauthorized state manipulation.

Technologies: Vyper. Vendors: Vyper.

Quick answers

Is CVE-2021-48018 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-48018 being exploited in the wild.
How severe is CVE-2021-48018?: High severity, with a CVSS score of 7.4, published 21 October 2026.
Which products and versions are affected?: Vyper 0.2.13 to 0.2.14.
Is there a fix for CVE-2021-48018?: Yes: fixed in 0.2.15. Until then: Do not use the @nonreentrant decorator in versions 0.2.13 through 0.2.14; upgrade to version 0.2.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-48018 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-48018?: Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.2.15

Do not use the @nonreentrant decorator in versions 0.2.13 through 0.2.14; upgrade to version 0.2.15 or later.

Technical details

The @nonreentrant decorator in Vyper allocates storage slots for reentrancy locks at the same memory addresses as contract state variables, causing the lock mechanism to overwrite critical data when activated. This is a storage layout collision bug triggered by any function call using @nonreentrant. The vulnerability was fixed in version 0.2.15.

Affected products

Vyper Vyper 0.2.13 to 0.2.14

Timeline

2021-07-27: disclosed
2021-07-27: patched: Fixed in version 0.2.15

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.