CVE-2023-32059 Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls

What is CVE-2023-32059?

CVE-2023-32059 is a high-severity code injection vulnerability in vyperlang vyper, published on 11 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.

Weakness: CWE-683

Which versions are affected by CVE-2023-32059?

3 open source packages ship an affected version, including vyper. It affects 1 product.

Products include Vyperlang Vyper.

How do I fix CVE-2023-32059?

Upgrade vyper to 0.3.8 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-32059 being exploited?

There is no known exploitation of CVE-2023-32059 in the wild and no public exploit code.

Other vulnerabilities in vyperlang vyper

• CVE-2024-24563 Vyper array negative index vulnerability Critical 9.8
• CVE-2024-24561 Vyper bounds check on built-in `slice()` function can be overflowed Critical 9.8
• CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks Critical 9.1
• CVE-2022-24845 Integer bounds error in Vyper High 8.8
• CVE-2022-29255 Multiple evaluation of contract address in call in vyper High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-ph9x-4vc9-m39g, PYSEC-2023-79.