GHSA-4w26-8p97-f4jp

Suggest an improvement
Source
https://github.com/advisories/GHSA-4w26-8p97-f4jp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-4w26-8p97-f4jp/GHSA-4w26-8p97-f4jp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4w26-8p97-f4jp
Aliases
Published
2025-02-21T22:43:33Z
Modified
2025-04-09T20:36:40Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
AugAssign evaluation order causing OOB write within the object in Vyper
Details

Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the bounds check will not be re-evaluated during the write portion of the statement. In other words, the following code

def poc():
    a: DynArray[uint256, 2] = [1, 2]
    a[1] += a.pop()

is equivalent to:

def poc():
    a: DynArray[uint256, 2] = [1, 2]
    a[1] += a[len(a) - 1]
    a.pop()

rather than:

def poc():
    a: DynArray[uint256, 2] = [1, 2]
    s: uint256 = a[1]
    t: uint256 = a.pop()
    a[1] = s + t  # reverts due to oob access
Database specific 
{
    "cwe_ids":  [
        "CWE-787"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-02-21T22:43:33Z",
    "nvd_published_at":  "2025-02-21T22:15:13Z",
    "severity":  "LOW"
}
References

Affected packages

PyPI / vyper

Package

Name
vyper
View open source insights on deps.dev
Purl
pkg:pypi/vyper

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.4.1

Affected versions

0.*
0.1.0b1
0.1.0b2
0.1.0b3
0.1.0b4
0.1.0b5
0.1.0b6
0.1.0b7
0.1.0b8
0.1.0b9
0.1.0b10
0.1.0b11
0.1.0b12
0.1.0b13
0.1.0b14
0.1.0b15
0.1.0b16
0.1.0b17
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.15
0.2.16
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9
0.3.10rc1
0.3.10rc2
0.3.10rc3
0.3.10rc4
0.3.10rc5
0.3.10
0.4.0b1
0.4.0b2
0.4.0b3
0.4.0b4
0.4.0b5
0.4.0b6
0.4.0rc1
0.4.0rc2
0.4.0rc3
0.4.0rc4
0.4.0rc5
0.4.0rc6
0.4.0
0.4.1b1
0.4.1b2
0.4.1b3
0.4.1b4
0.4.1rc1
0.4.1rc2
0.4.1rc3

Database specific

last_known_affected_version_range 
"<= 0.4.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-4w26-8p97-f4jp/GHSA-4w26-8p97-f4jp.json"