CVE-2025-27105
Last modified
CVE-2025-27105 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the bounds check will not be re-evaluated during the write portion of the statement. This issue has been addressed in version 0.4.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vyperlang | Vyper | < 0.4.1 |
References
- https://github.com/vyperlang/vyper/security/advisories/GHSA-4w26-8p97-f4jpExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-27105?
How severe is CVE-2025-27105?
How do I fix CVE-2025-27105?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-2710A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and cla…6.1
- CVE-2025-27100lakeFS is an open-source tool that transforms your object st…6.5
- CVE-2025-27101Opal is OBiBa’s core database application for biobanks or ep…7.3
- CVE-2025-27102Agate is central authentication server software for OBiBa ep…5.4
- CVE-2025-27103DataEase is an open source business intelligence and data vi…6.5
- CVE-2025-27104vyper is a Pythonic Smart Contract Language for the EVM. Mul…7.5
- CVE-2025-27106binance-trading-bot is an automated Binance trading bot with…8.8
- CVE-2025-27107Integrated Scripting is a tool for creating scripts for hand…8.6
- CVE-2025-27108dom-expressions is a Fine-Grained Runtime for Performant DOM…6.1
- CVE-2025-27109solid-js is a declarative, efficient, and flexible JavaScrip…7.3
- CVE-2025-2711A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has…6.1
- CVE-2025-27110Libmodsecurity is one component of the ModSecurity v3 projec…7.5
Are you affected by CVE-2025-27105?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST