Is CVE-2026-114116 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114116 being exploited in the wild.

How severe is CVE-2026-114116?

Medium severity, with a CVSS score of 5.3, published 21 October 2026.

Which products and versions are affected?

Vyper 0.1.0b1 before 0.1.0b17; 0.4.1 through 0.5.0b1.

How is CVE-2026-114116 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114116?

Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114116: Vyper source-line table parsing allows numeric literal value manipulation

CVE-2026-114116 · Severity: medium · CVSS 5.3 · Published 2026-10-21

Vyper is a smart contract programming language that compiles code to run on blockchain networks. A flaw in how Vyper parses source code allows an attacker to hide special characters in comments or strings that cause numeric constants (addresses, amounts, values) to be silently changed during compilation. An attacker with code contribution access could redirect funds or alter contract behavior without any warning.

Technologies: Vyper. Vendors: Vyper.

Quick answers

Is CVE-2026-114116 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114116 being exploited in the wild.
How severe is CVE-2026-114116?: Medium severity, with a CVSS score of 5.3, published 21 October 2026.
Which products and versions are affected?: Vyper 0.1.0b1 before 0.1.0b17; 0.4.1 through 0.5.0b1.
Is there a fix for CVE-2026-114116?: Yes: fixed in 0.1.0b17, 0.5.0b2. Until then: Until a fix is available, reject the eight line-separator characters (U+000B, U+000C, U+001C, U+001D, U+001E, U+0085, U+2028, U+2029) in source files before compilation. Previously compiled contracts should be assessed and, if affected, recompiled and redeployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114116 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114116?: Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.1.0b17, 0.5.0b2

Until a fix is available, reject the eight line-separator characters (U+000B, U+000C, U+001C, U+001D, U+001E, U+0085, U+2028, U+2029) in source files before compilation. Previously compiled contracts should be assessed and, if affected, recompiled and redeployed.

Technical details

Vyper's source-line table construction uses Python's str.splitlines() which recognizes eight additional line-separator characters (U+000B, U+000C, U+001C, U+001D, U+001E, U+0085, U+2028, U+2029) that the Python parser itself does not treat as newlines. This causes source lookups for numeric literals to reference incorrect text, allowing addresses and constants to be reinterpreted. An attacker can place these characters in comments, docstrings, strings, or indentation to trigger cumulative source displacement; the exploit requires code contribution access but produces no compiler warnings.

Affected products

Vyper Vyper 0.1.0b1 before 0.1.0b17; 0.4.1 through 0.5.0b1

Timeline

2026-10-06: disclosed
2026-10-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.