GHSA-c7pr-343r-5c46

GitHub Security Advisory

missing clamps for decimal args in external functions

✓ GitHub Reviewed MODERATE Has CVE

### Impact

The following code does not properly validate that its input is in bounds.

```python
@external
def foo(x: decimal) -> decimal:
return x
```

### Patches
0.3.0 / #2447

### Workarounds
Don't use decimal args

PyPI vyper

Affected versions: 0 (fixed in 0.3.0)

CVE-2021-41122

GHSA ID

GHSA-c7pr-343r-5c46

Published

October 6, 2021 5:48 PM

Last Modified

November 18, 2024 10:44 PM

CVSS Score

5.0 /10

Primary Ecosystem

PyPI

Primary Package

vyper

GitHub Reviewed

✓ Yes

Last updated: June 18, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.