PyPI/vyper CVE-2024-24567: medium 4.8, EPSS 0.48%

Vyper's raw_call `value=` kwargs not disabled for static and delegate calls

Action: Upgrade vyper to 0.4.0 or later.

pip install vyper==0.4.0

Affected

Fixed versions

Sources

• osv: GHSA-x2c2-q32w-4w6m
• https://github.com/vyperlang/vyper/security/advisories/GHSA-x2c2-q32w-4w6m
• https://nvd.nist.gov/vuln/detail/CVE-2024-24567
• https://github.com/vyperlang/vyper/pull/3755
• https://github.com/vyperlang/vyper/commit/a2df08888c318713742c57f71465f32a1c27ed72
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-151.yaml
• https://github.com/vyperlang/vyper
• https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py#L1100

CVE-2024-24567 · published 2024-01-30T18:42:28Z · modified 2026-09-10T03:50:09.737044532Z · JSON