GitHub Advisoryadvisory · PyPI

GHSA-vqgp-4jgj-5j64 Py-EVM is vulnerable to arbitrary bytecode injection

HIGH Published 2018-11-21 Modified 2026-06-05 Official page ↗
Aliases
CVE-2018-18920
Ecosystem
PyPI
Packages
py-evm
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-119
Reviewed
2020-06-16

Affected packages

• PyPI py-evm: <= 0.2.0a33 (no fix yet)

Description

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid."

Related

Alias · CVE (1)

  • CVE-2018-18920 Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100,… vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References