tocsin

PyPI/vyper CVE-2023-42460: high 7.5, EPSS 0.67%

Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi_decode()` can be constructed which allow

Action: Upgrade vyper to 0.3.10 or later.

pip install vyper==0.3.10

Affected

introducedfixedlast affected
0.3.40.3.10-

Fixed versions

0.3.10

Sources

CVE-2023-42460 · published · modified · JSON