Executive brief
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Affected products
- PyPI vyper
Junglewise Threat Intelligence
CVE-2025-47285: PYSEC-2026-2029 - Vyper's `concat()` builtin may elide side-effects for zero-length arguments
CVE-2025-47285 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: vyper (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2028 - Vyper's `slice()` may elide side-effects when output length is 0
- PYSEC-2025-31 - vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid do
- PYSEC-2025-30 - vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a
- PYSEC-2025-29 - vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of deci
- PYSEC-2025-33 - Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), th