CVE-2023-40015

PyPI/vyper CVE-2023-40015: medium 5.3, EPSS 0.49%

Vyper: reversed order of side effects for some operations

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-g2xh-c426-v8mf
• https://github.com/vyperlang/vyper/security/advisories/GHSA-g2xh-c426-v8mf
• https://nvd.nist.gov/vuln/detail/CVE-2023-40015
• https://github.com/vyperlang/vyper/issues/3604
• https://github.com/vyperlang/vyper/issues/4019
• https://github.com/vyperlang/vyper/pull/4157
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-167.yaml
• https://github.com/vyperlang/vyper

CVE-2023-40015 · published 2023-09-04T16:39:00Z · modified 2025-06-18T18:23:19.820952Z · JSON

PyPI/vyper CVE-2023-40015: medium 5.3, EPSS 0.49%

Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right. `unsafe_

Action: Upgrade vyper to 0.3.10rc1 or later.

pip install vyper==0.3.10rc1

Affected

Fixed versions

Sources

• osv: PYSEC-2023-167
• https://github.com/vyperlang/vyper/security/advisories/GHSA-g2xh-c426-v8mf

CVE-2023-40015 · published 2023-09-04T18:15:00Z · modified 2023-11-08T04:13:16.353084Z · JSON