Vyper 0.1.0b1 through 0.5.0b1 mixes character‑based line offsets with Python's UTF‑8 byte column offset values, causing the reconstruction of numeric literals to be misaligned when multi‑byte characters exist. An attacker can supply source containing non‑ASCII identifiers that normalize to ASCII, or an invisible byte‑order mark, to silently replace addresses, integers or other constants in the compiled bytecode, potentially enabling unintended functionality or data manipulation.

Vyper and its variants, specifically versions 0.1.0b1 up to 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1.

The vulnerability carries a CVSS score of 6, indicating moderate severity on integrity and potentially safety of contracts. The EPSS score of less than 1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits. An attacker would need to influence the compilation of malicious Vyper code, typically via control over the source or the build process. Once compiled, manipulated constants could undermine contract logic or grant unintended privileges.