CVE-2026-123783 in Skyvern
Summary
by MITRE • 11/06/2026
Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is_safe_script_code AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The identified vulnerability within Skyvern versions up to 1.0.56 represents a critical security flaw rooted in improper handling of Python bytecode execution, specifically classified under CWE-94 Improper Control of Generation of Code (Code Injection). The core technical issue arises from the application's reliance on reconstructing function objects using the raw bytes and type information provided by users via the CodeType constructor. While Skyvern implements a security measure designed to prevent arbitrary code execution through an Abstract Syntax Tree denylist that blocks dangerous keywords such as import, this mechanism is fundamentally bypassed because it only inspects the syntactic structure of Python source code rather than the semantic behavior or runtime capabilities of compiled bytecode objects. By directly constructing function objects from raw bytecode, attackers can effectively sidestep static analysis checks since the resulting object does not contain the forbidden syntax strings that trigger the denylist filters.
This architectural weakness allows authenticated users to execute arbitrary commands within the context of the Skyvern server process with elevated privileges. The attacker crafts a payload consisting of compiled Python code that imports restricted modules like subprocess or socket, which are typically blocked in sandboxed environments to prevent system-level access and network interaction. Once these modules are imported through the reconstructed function object, the attacker gains full control over the underlying operating system, enabling actions such as reading sensitive configuration files, exfiltrating data from internal networks, or pivoting to other systems within the infrastructure. This scenario aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically highlighting how attackers can abuse scripting engines when proper sandbox isolation is not enforced at the bytecode level rather than just the source code parsing stage.
The operational impact of this vulnerability is severe due to its potential for remote code execution on the backend server infrastructure. Since authentication is required, an attacker who has compromised user credentials or exploits a separate authentication bypass can leverage this flaw to achieve persistent access and lateral movement within the organization's network. The ability to import standard library modules means that the scope of damage extends beyond simple data leakage to include complete system compromise, including denial-of-service conditions through resource exhaustion or destructive file operations. This undermines the trust model of the application where users are expected to run untrusted scripts in an isolated environment, effectively turning a feature intended for automation into a vector for full server takeover.
To mitigate this vulnerability, immediate patching to version 1.0.57 or later is required as it addresses the underlying bytecode handling logic. In addition to updating software components, organizations should enforce strict input validation and avoid using dynamic code execution features unless absolutely necessary, preferring safer alternatives like predefined API calls for common tasks. If custom script execution must be supported, implementing a robust sandboxing solution that isolates processes at the operating system level rather than relying solely on application-level filtering is essential. Furthermore, deploying runtime application self-protection mechanisms and monitoring for unusual subprocess or network activity originating from the Skyvern service can help detect exploitation attempts in real-time while reducing the blast radius of any successful attack.