{"action":"Upgrade vyper to 0.4.0b1 or later.","affected":[{"fixed":"0.4.0b1","introduced":"0"}],"component":"vyper","cve_ids":["CVE-2024-24567"],"ecosystem":"PyPI","epss":0.00485,"exploited":false,"fixed_versions":["0.4.0b1"],"ghsa_id":"GHSA-x2c2-q32w-4w6m","id":"tcs_01M5KGM5433FD6NK4G3MHG6QG4","modified_at":"2024-11-21T14:57:10.515557Z","published_at":"2024-01-30T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-151","https://github.com/vyperlang/vyper/security/advisories/GHSA-x2c2-q32w-4w6m","https://github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py#L1100"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2024-151","url":"https://osv.dev/vulnerability/PYSEC-2024-151"}],"summary":"Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the c"}