{"cve":"CVE-2018-18920","nvd":{"published":"2018-11-12T02:29:00.233","modified":"2026-06-17T01:48:07.327","status":"Modified","description":"Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '\"stack\": [100, 100, 0]' where b'\\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to \"smart contracts can be executed indefinitely without gas being paid.\"","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-119"],"references":["https://github.com/ethereum/py-evm/issues/1448","https://twitter.com/AlexanderFisher/status/1060923428641878019","https://twitter.com/NettaLab/status/1060889400102383617","https://www.reddit.com/r/ethereum/comments/9vkk2g/netta_labs_claim_to_have_found_a_vulnerability_in/e9d3wyx/","https://github.com/ethereum/py-evm/issues/1448"],"products":["ethereum:py-evm"],"source":"nvd","synced_at":"2026-10-19T20:53:59.789560037+00:00"},"epss":{"cve":"CVE-2018-18920","score":0.02926,"percentile":0.87064,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-vqgp-4jgj-5j64","url":"https://osv.dev/vulnerability/GHSA-vqgp-4jgj-5j64","summary":"Py-EVM is vulnerable to arbitrary bytecode injection","modified":"2026-06-05T18:00:16.684062959Z","packages":[{"ecosystem":"PyPI","name":"py-evm","purl":"pkg:pypi/py-evm","ranges":["<=0.2.0a33"],"fixed":[]}]},{"id":"PYSEC-2018-155","url":"https://osv.dev/vulnerability/PYSEC-2018-155","summary":"","modified":"2026-05-21T15:00:12.147376049Z","packages":[{"ecosystem":"PyPI","name":"evm-py","purl":"pkg:pypi/evm-py","ranges":["<=0.2.0-alpha\\.33"],"fixed":[]}]},{"id":"PYSEC-2018-96","url":"https://osv.dev/vulnerability/PYSEC-2018-96","summary":"","modified":"2026-05-20T08:11:31.094686425Z","packages":[{"ecosystem":"PyPI","name":"py-evm","purl":"pkg:pypi/py-evm","ranges":["<0.2.0a33"],"fixed":["0.2.0a33"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}