Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Skyvern versions before 1.0.45 allow code execution via text prompts

CVE-2026-82447 · published 5 days ago
Summary

The Skyvern automation tool versions earlier than 1.0.45 let specially crafted text inputs run code on the server. This happens because the tool processes the same prompt twice, once in a safe mode and then again without protection, allowing attackers to slip in malicious instructions. Update to version 1.0.45 or later, and review any custom prompts for unexpected content.

What to do
  • Update skyvern-ai skyvern to version 1.0.45 or later.
Affected software
VendorProductAffected versions
skyvern-ai skyvern < 1.0.45
Original advisory text
Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.
References
Severity
9.4 Critical
CVSS 3.1: 8.8 (NVD)
CVSS 4.0: 8.7 (NVD)
Exploitation
EPSS <1%
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published29 Aug 2026
Updated2 Sep 2026
First seen29 Aug 2026
Sources
CVE-2026-82447 · NVD
CVE-2026-82447 · MITRE
CVE-2026-82447 · OSV
Monitor software like this
Free during beta