{"id":"CVE-2025-47285","aliases":["GHSA-qhr6-mgqr-mchm","PYSEC-2026-2029"],"url":"https://o3.security/vulnerability/CVE-2025-47285","summary":"Vyper's `concat()` builtin may elide side-effects for zero-length arguments","details":"### Impact\n`concat()` may skip evaluation of side effects when the length of an argument is zero. this is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero:\nhttps://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L560-L562\n\nin practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal `b\"\"`; the only way to construct an empty bytestring which has side effects would be with the ternary operator introduced in v0.3.8, e.g. `b\"\" if self.do_some_side_effect() else b\"\"`.\n\nthe following example demonstrates how the issue would look in user code\n```vyper\ncounter: public(uint256)\n\n@external\ndef test() -> Bytes[256]:\n    a: Bytes[256] = concat(b\"\" if self.sideeffect() else b\"\", b\"aaaa\")\n    return a\n\ndef sideeffect() -> bool:\n    self.counter += 1\n    return True\n```\n\nthe severity assigned is low, since, as mentioned, this would be a very unusual pattern in user-code.\n\n### Patches\n\nfix is tracked in https://github.com/vyperlang/vyper/pull/4644\n\n### Workarounds\ndon't have side effects in expressions which construct zero-length bytestrings.\n\n### References\n_Are there any links users can visit to find out more?_","published":"2025-05-15T17:24:03.442Z","modified":"2026-08-12T03:51:17.382229279Z","cvss":null,"epss":{"score":0.00444,"percentile":0.37774,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"vyper","fixedVersion":null}],"fix":{"url":"https://github.com/vyperlang/vyper/pull/4644","label":"vyperlang/vyper#4644"},"references":[{"type":"WEB","url":"https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L560-L562"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47285.json"},{"type":"ADVISORY","url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-qhr6-mgqr-mchm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47285"},{"type":"FIX","url":"https://github.com/vyperlang/vyper/pull/4644"},{"type":"PACKAGE","url":"https://github.com/vyperlang/vyper"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:17.382229279Z"}}