{"id":"CVE-2018-18920","aliases":["EUVD-2018-0118","GHSA-vqgp-4jgj-5j64","PYSEC-2018-155","PYSEC-2018-96"],"status":"published","title":"Py-EVM is vulnerable to arbitrary bytecode injection","description":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02926,"percentile":0.87152,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2018-11-12T02:00:00Z","modified":"2026-10-20T10:51:34Z","fixes":[{"ecosystem":"PyPI","package":"py-evm","fixed_in":["0.2.0a33"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"py-evm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.2.0a33"}]}]},{"source":"osv","ecosystem":"PyPI","package":"py-evm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.2.0a33"}]}],"versions":["0.2.0a1","0.2.0a10","0.2.0a11","0.2.0a12","0.2.0a13","0.2.0a14","0.2.0a15","0.2.0a16","0.2.0a17","0.2.0a18","0.2.0a19","0.2.0a20","0.2.0a21","0.2.0a22","0.2.0a24","0.2.0a25","0.2.0a26","0.2.0a28","0.2.0a29","0.2.0a3","0.2.0a30","0.2.0a31","0.2.0a32","0.2.0a33","0.2.0a5","0.2.0a7","0.2.0a8","0.2.0a9"]},{"source":"osv","ecosystem":"PyPI","package":"evm-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.2.0-alpha\\.33"}]}]},{"source":"osv","ecosystem":"PyPI","package":"py-evm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0a33"}]}],"versions":["0.2.0a1","0.2.0a10","0.2.0a11","0.2.0a12","0.2.0a13","0.2.0a14","0.2.0a15","0.2.0a16","0.2.0a17","0.2.0a18","0.2.0a19","0.2.0a20","0.2.0a21","0.2.0a22","0.2.0a24","0.2.0a25","0.2.0a26","0.2.0a28","0.2.0a29","0.2.0a3","0.2.0a30","0.2.0a31","0.2.0a32","0.2.0a5","0.2.0a7","0.2.0a8","0.2.0a9"]}],"products":[{"vendor":"ethereum","product":"py-evm"}],"references":[{"url":"https://twitter.com/AlexanderFisher/status/1060923428641878019","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/ethereum/py-evm/issues/1448","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://twitter.com/NettaLab/status/1060889400102383617","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18920","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vqgp-4jgj-5j64","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/py-evm/PYSEC-2018-96.yaml","tags":["web"]},{"url":"https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/evm-py/PYSEC-2018-155.yaml","tags":["web"]},{"url":"https://github.com/ethereum/py-evm","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-18920","description":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"","status":"published","published":"2018-11-12T02:00:00Z","modified":"2024-08-05T11:23:08.555Z","updated_at":"2026-11-02T14:35:11.426178Z"}],"euvd":[{"id":"EUVD-2018-0118","description":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"","status":"published","published":"2018-11-12T02:00:00Z","modified":"2024-08-05T11:23:08Z","updated_at":"2026-11-03T02:39:35.233033Z"}],"ghsa":[{"id":"GHSA-vqgp-4jgj-5j64","title":"Py-EVM is vulnerable to arbitrary bytecode injection","description":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"","status":"published","published":"2018-11-21T22:23:04Z","modified":"2026-06-05T17:53:32Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:40:17.745826Z"}],"nvd":[{"id":"CVE-2018-18920","description":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"","status":"published","published":"2018-11-12T02:29:00.233Z","modified":"2026-06-17T01:48:07.327Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:47.196456Z"}],"osv":[{"id":"CVE-2018-18920","description":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"","status":"published","published":"2018-11-12T02:29:00.233Z","modified":"2026-10-20T10:51:34.628162772Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"GHSA-vqgp-4jgj-5j64","title":"Py-EVM is vulnerable to arbitrary bytecode injection","description":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"","status":"published","published":"2018-11-21T22:23:04Z","modified":"2026-06-05T18:00:16.684062959Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"PYSEC-2018-155","description":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"","status":"published","published":"2018-11-12T02:29:00.233Z","modified":"2026-05-21T15:00:12.147376049Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"PYSEC-2018-96","description":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"","status":"published","published":"2018-11-12T02:29:00Z","modified":"2026-05-20T08:11:31.094686425Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}