CVE-2026-82447

Skyvern before 1.0.45 contains a sandbox escape (CWE-1336) in its TextPromptBlock, which renders prompts twice: once inside a sandboxed Jinja environment and again through an unsandboxed Jinja environment. An attacker with low privileges who can influence workflow parameters or the output of an upstream workflow block can inject malicious Jinja template syntax, which is then evaluated outside the sandbox. Successful exploitation allows arbitrary code execution with the privileges of the Skyvern server process, giving the attacker high confidentiality, integrity, and availability impact on that system. All self-hosted Skyvern deployments running a version prior to 1.0.45 are affected, particularly those where untrusted users can define or influence workflow inputs. As of now there is no known public proof-of-concept, no listing in CISA's KEV, and no confirmed exploitation in the wild.

What to do: Upgrade Skyvern to version 1.0.45 or later, which fixes the double-render issue in TextPromptBlock. Until then, restrict who can edit workflows and supply workflow parameters or upstream block outputs, treat untrusted inputs to prompt blocks as untrusted template data, and audit running deployments for unexpected process activity under the Skyvern service account.