Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Vyper versions from 0.3.1 before 0.3.8 are affected: when a contract calls raw_call with both max_outsize=0 and revert_on_failure=False, the compiler generates incorrect bytecode, so the returned success flag can be either True or False depending on memory contents. An attacker does not need access; any contract using this call pattern receives the wrong result, which can affect its logic. Upgrade to Vyper 0.3.8. As a workaround, set max_outsize to a value greater than 0.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0088, the 59th percentile, on 7 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:36 UTC First seen by agentprime
- 31 Oct 2026, 14:36 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-w9g2-3w7p-72g9
- OSV: GHSA-w9g2-3w7p-72g9
- github.com/vyperlang/vyper/security/advisories/GHSA-w9g2-3w7p-72g9
- nvd.nist.gov/vuln/detail/CVE-2023-30629
- github.com/lidofinance/gate-seals/pull/5/files
- github.com/vyperlang/vyper/commit/851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae
- docs.vyperlang.org/en/v0.3.7/built-in-functions.html#raw_call
- github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vy#L164
- github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2023-131.yaml
- github.com/vyperlang/vyper