What’s Vulnerable › Vulnerabilities

CVE-2026-82447: Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-29 · updated 2026-09-23
• Weakness: CWE-1336

Description

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.

Affected products

• Skyvern-AI skyvern: from 0.2.1 before 1.0.45 — fixed in 1.0.45

How to fix

Upgrade to a fixed version: Skyvern-AI skyvern 1.0.45. Check the vendor advisory for mitigations.

References

• https://github.com/Skyvern-AI/skyvern
• https://github.com/Skyvern-AI/skyvern/blob/v1.0.44/skyvern/forge/sdk/prompting.py
• https://github.com/Skyvern-AI/skyvern/blob/v1.0.44/skyvern/forge/sdk/workflow/models/block.py
• https://github.com/Skyvern-AI/skyvern/commit/d723de621d5b3a340f3cc4d5b46bfe40a9a3124e
• https://www.vulncheck.com/advisories/skyvern-before-1.0.45-sandbox-escape-via-textpromptblock

Get alerted when CVE-2026-82447 or the next vulnerability affects your stack