{"action":"Upgrade py-evm to 0.2.0a33 or later.","affected":[{"fixed":"0.2.0a33","introduced":"0"}],"component":"py-evm","cve_ids":["CVE-2018-18920"],"ecosystem":"PyPI","epss":0.02926,"exploited":false,"fixed_versions":["0.2.0a33"],"ghsa_id":"GHSA-vqgp-4jgj-5j64","id":"tcs_01M5KG89VNDXRWTR1MCE7E8S1G","modified_at":"2026-05-20T08:11:31.094686425Z","published_at":"2018-11-12T02:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2018-96","https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/","https://twitter.com/NettaLab/status/1060889400102383617","https://twitter.com/AlexanderFisher/status/1060923428641878019","https://github.com/ethereum/py-evm/issues/1448","https://github.com/advisories/GHSA-vqgp-4jgj-5j64"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2018-96","url":"https://osv.dev/vulnerability/PYSEC-2018-96"},{"source":"nvd","source_id":"CVE-2018-18920","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18920"}],"summary":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution fai"}