{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.2.0-alpha\\.33"}],"component":"evm-py","cve_ids":["CVE-2018-18920"],"ecosystem":"PyPI","epss":0.02926,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-vqgp-4jgj-5j64","id":"tcs_01M5KG7T8SE2YGG48MC5KVDJ85","modified_at":"2026-05-21T15:00:12.147376049Z","published_at":"2018-11-12T02:29:00.233Z","references":["https://osv.dev/vulnerability/PYSEC-2018-155","https://twitter.com/AlexanderFisher/status/1060923428641878019","https://twitter.com/NettaLab/status/1060889400102383617","https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/","https://github.com/ethereum/py-evm/issues/1448"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2018-155","url":"https://osv.dev/vulnerability/PYSEC-2018-155"}],"summary":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution fai"}