Vyper builds its source‑line table with the Python function str.splitlines(). This function treats characters such as form feed and Unicode line separators (U+2028, U+2029) as break points, while the Vyper parser ignores them. An attacker who contributes source code can insert these characters within comments, string literals or indentation, causing numeric literals such as addresses, integers or decimals to be re‑classified from a different line. The compiled contract therefore contains altered constant values, potentially changing its logic or state in a way that benefits the attacker.

Affected versions include Vyper 0.1.0b1 up to and including 0.1.0b16, and all releases from 0.4.1 through 0.5.0b1. The vendor is vyperlang, product Vyper. Any environment that compiles contracts using these versions is vulnerable, regardless of the operating system or deployment platform.

The CVSS score of 6 indicates moderate severity, and the EPSS score of less than 1% points to a very low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Exploitation requires control over the source file that will be compiled, typically during code review, merge or deployment. The attack vector is a source‑code manipulation that exploits the compiler’s line‑splitting logic.