Vyper Vulnerability in Pythonic Smart Contract Language for EVM
CVE-2025-27105

2.3LOW

Key Information:

Vendor
Vyperlang
Status
Vyper
Vendor
CVE Published:
21 February 2025

Summary

The Vyper programming language for the Ethereum Virtual Machine (EVM) has a critical issue in how it processes AugAssign statements, specifically when targeting a dynamic array. In scenarios where the right-hand side (rhs) manipulates the array, the language caches the target location, thereby preventing proper bounds checking during the write operation. As a result, this flaw can lead to unintentional modifications and security risks within smart contracts. Users are strongly encouraged to update to version 0.4.1 to safeguard against potential exploits, as no workarounds exist.

Affected Version(s)

vyper < 0.4.1

References

https://github.com/vyperlang/vyper/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.