Answer in brief
CVE-2026-114114 records a Medium severity (CVSS 6.0) vulnerability in Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters. The current sources do not mark it as known exploited. The current feed maps vyperlang/vyper (generic), vyperlang/vyper (generic), vyperlang/vyper (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps vyperlang/vyper (generic), vyperlang/vyper (generic), vyperlang/vyper (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| vyperlang/vypergeneric | >=0.1.0b1 <0.1.0b12 | 0.1.0b12 |
| vyperlang/vypergeneric | >=0.1.0b14 <0.1.0b15 | 0.1.0b15 |
| vyperlang/vypergeneric | >=0.4.1 <=0.5.0b1 | Not reported |
Published upstream
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 21, 2026
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.
Quoted source text, attributed separately from HOL analysis.