{"action":"Upgrade vyper to 0.3.10rc1 or later.","affected":[{"fixed":"0.3.10rc1","introduced":"0"}],"component":"vyper","cve_ids":["CVE-2023-41052"],"ecosystem":"PyPI","epss":0.00536,"exploited":false,"fixed_versions":["0.3.10rc1"],"ghsa_id":"GHSA-4hg4-9mf5-wxxq","id":"tcs_01M5KGJNHVZJPM0P6YYR4PMVKE","modified_at":"2023-11-08T04:13:24.249162Z","published_at":"2023-09-04T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-168","https://github.com/vyperlang/vyper/pull/3583","https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxq"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2023-168","url":"https://osv.dev/vulnerability/PYSEC-2023-168"}],"summary":"Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not fol"}