{"action":"Upgrade vyper to 0.4.0b1 or later.","affected":[{"fixed":"0.4.0b1","introduced":"0"}],"component":"vyper","cve_ids":["CVE-2024-24560"],"ecosystem":"PyPI","epss":0.00526,"exploited":false,"fixed_versions":["0.4.0b1"],"ghsa_id":"GHSA-gp3w-2v2m-p686","id":"tcs_01M5KGM4HZNWBA2ZA8KZ1WBBTT","modified_at":"2024-11-21T14:57:09.929094Z","published_at":"2024-02-02T17:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-148","https://github.com/vyperlang/vyper/security/advisories/GHSA-gp3w-2v2m-p686"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2024-148","url":"https://osv.dev/vulnerability/PYSEC-2024-148"}],"summary":"Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at byte 28, and allocate the return buffer t"}