CVE-2026-82447: high-severity vulnerability in Skyvern-AI skyvern
Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.8%
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Skyvern-AI · skyvernRelated CVEs — Skyvern-AI skyvern
In the same product, most dangerous first.
References
https://github.com/Skyvern-AI/skyvernhttps://github.com/Skyvern-AI/skyvern/blob/v1.0.44/skyvern/forge/sdk/prompting.pyhttps://github.com/Skyvern-AI/skyvern/blob/v1.0.44/skyvern/forge/sdk/workflow/models/block.pyhttps://github.com/Skyvern-AI/skyvern/commit/d723de621d5b3a340f3cc4d5b46bfe40a9a3124ehttps://www.vulncheck.com/advisories/skyvern-before-1.0.45-sandbox-escape-via-textpromptblock