CVE-2026-82447 in Skyvern
Summary
by MITRE • 08/29/2026
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/29/2026
The identified security flaw resides within the Skyvern automation framework prior to version 1.0.45, specifically affecting the TextPromptBlock component which is responsible for processing dynamic content using Jinja2 templating engines. This vulnerability represents a critical sandbox escape scenario where the application fails to maintain isolation between trusted and untrusted execution contexts during template rendering operations. The core technical deficiency lies in the dual-pass rendering mechanism employed by the framework, wherein input data undergoes an initial evaluation within a restricted, sandboxed environment intended to prevent arbitrary code execution, followed immediately by a second pass through an unsandboxed Jinja2 context that lacks these protective constraints.
This architectural design creates a dangerous vector for server-side template injection attacks because malicious actors can craft payloads designed to bypass the initial sanitization or filtering applied in the first rendering phase. By injecting carefully constructed Jinja syntax into workflow parameters or leveraging output from upstream blocks, an attacker can introduce code fragments that remain inert during the sandboxed evaluation but become executable when processed by the subsequent unsandboxed engine. This effectively neutralizes the security controls intended to limit the blast radius of template injection vulnerabilities, allowing the injected payload to execute with the same privileges as the server process running Skyvern.
The operational impact of this vulnerability is severe, granting remote attackers the ability to achieve arbitrary code execution on the host system hosting the Skyvern instance. Since the executed commands run under the context of the application's service account or user identity, successful exploitation can lead to full compromise of the underlying infrastructure. This includes potential access to sensitive data processed by the automation workflows, lateral movement within internal networks if the server has broader connectivity permissions, and complete loss of integrity for any automated tasks managed through the platform. The ability to execute code with server process privileges elevates this from a simple injection flaw to a critical system-level compromise vector.
To mitigate this risk, organizations must immediately upgrade Skyvern to version 1.0.45 or later where these sandboxing mechanisms have been corrected and input validation has been strengthened. In environments where upgrading is not instantly feasible, strict input sanitization should be implemented at the application layer to filter out dangerous Jinja delimiters and control structures before they reach the TextPromptBlock component. Additionally, deploying web application firewalls with specific rules for template injection patterns can provide a temporary defensive layer while patching efforts are underway. It is also advisable to review workflow configurations to minimize the exposure of user-controllable inputs to templating engines wherever possible, adhering to the principle of least privilege by ensuring that automation services run under restricted accounts with minimal system-level permissions.