CVE-2025-47285

Vyper's concat() builtin may elide side-effects for zero-length arguments

Workarounds

don't have side effects in expressions which construct zero-length bytestrings.

References

Are there any links users can visit to find out more?

concat() may skip evaluation of side effects when the length of an argument is zero. this is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero:
https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L560-L562

in practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal b""; the only way to construct an empty bytestring which has side effects would be with the ternary operator introduced in v0.3.8, e.g. b"" if self.do_some_side_effect() else b"".

the following example demonstrates how the issue would look in user code

counter: public(uint256)

@external
def test() -> Bytes[256]:
    a: Bytes[256] = concat(b"" if self.sideeffect() else b"", b"aaaa")
    return a

def sideeffect() -> bool:
    self.counter += 1
    return True

the severity assigned is low, since, as mentioned, this would be a very unusual pattern in user-code.

Kodem intelligence

Already deployed Kodem?

fix is tracked in https://github.com/vyperlang/vyper/pull/4644

1. What is CVE-2025-47285? CVE-2025-47285 is a low-severity security vulnerability in vyper (pip), affecting versions <= 0.4.2rc1. No fixed version is listed yet.
2. Which versions of vyper are affected by CVE-2025-47285? vyper (pip) versions <= 0.4.2rc1 is affected.
3. Is there a fix for CVE-2025-47285? No fixed version is listed for CVE-2025-47285 yet. Monitor the advisory for updates and apply mitigations in the interim.
4. Is CVE-2025-47285 exploitable, and should I be worried? Whether CVE-2025-47285 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2025-47285 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Other vulnerabilities in vyper