CVE-2026-123783: Skyvern through 1.0.56 Script Sandbox Bypass via types.CodeType Bytecode
Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the issafescriptcode AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Skyvern user who can deploy scripts can exploit the bypass. The attack relies on submitting a script that reconstructs functions from raw bytecode to evade the AST denylist.
What level of access could successful exploitation provide?
Successful exploitation can run code in the Skyvern server process. The bypass can be used to import modules blocked by the sandbox, including subprocess or socket.
Are versions later than 1.0.56 affected?
The available information identifies Skyvern through version 1.0.56 as affected. It does not state whether later versions are affected or fixed.