CVE-2026-123783: high-severity vulnerability in Skyvern-AI skyvern
Skyvern through 1.0.56 Script Sandbox Bypass via types.CodeType Bytecode
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7
Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is_safe_script_code AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Skyvern-AI · skyvernRelated CVEs — Skyvern-AI skyvern
In the same product, most dangerous first.
References
https://github.com/Skyvern-AI/skyvernhttps://github.com/Skyvern-AI/skyvern/blob/v1.0.56/skyvern/forge/sdk/workflow/code_block_safety.py#L106-L142https://github.com/Skyvern-AI/skyvern/blob/v1.0.56/skyvern/forge/sdk/workflow/service.py#L1509-L1511https://github.com/Skyvern-AI/skyvern/commit/31a64c1a4b5dfaf1e76a7164845e10f2d68248dchttps://github.com/Skyvern-AI/skyvern/issues/8927https://github.com/Skyvern-AI/skyvern/pull/8937https://www.vulncheck.com/advisories/skyvern-through-1.0.56-script-sandbox-bypass-via-types-codetype-bytecode