CVE-2026-82447: Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock

Q: Who can exploit this issue?

An attacker needs the ability to supply workflow parameters or influence output from an upstream block. Those values can carry malicious Jinja template syntax into TextPromptBlock rendering.

Q: What level of access can successful exploitation provide?

Successful exploitation can result in arbitrary code execution with the privileges of the Skyvern server process. The impact includes compromise of confidentiality, integrity, and availability.

Q: Which deployments are affected?

Skyvern versions before 1.0.45 are affected when TextPromptBlock processes attacker-controlled workflow parameters or upstream block output.

Q: What should be prioritized for remediation?

Upgrade Skyvern to version 1.0.45 or later. Until upgrading, limit untrusted control over workflow parameters and upstream block output that may be rendered by TextPromptBlock.

Published Aug 29, 2026

Updated

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.

Affected Software

1 affected component

Skyvern Skyvern<1.0.45

Event History

Aug 29, 2026

CVE Published

via MITRE·12:05 PM

Data Sourced

via MITRE·12:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs the ability to supply workflow parameters or influence output from an upstream block. Those values can carry malicious Jinja template syntax into TextPromptBlock rendering.

What level of access can successful exploitation provide?

Successful exploitation can result in arbitrary code execution with the privileges of the Skyvern server process. The impact includes compromise of confidentiality, integrity, and availability.

Which deployments are affected?

Skyvern versions before 1.0.45 are affected when TextPromptBlock processes attacker-controlled workflow parameters or upstream block output.

What should be prioritized for remediation?

Upgrade Skyvern to version 1.0.45 or later. Until upgrading, limit untrusted control over workflow parameters and upstream block output that may be rendered by TextPromptBlock.

CVE-2026-82447: Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of access can successful exploitation provide?

Which deployments are affected?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of access can successful exploitation provide?

Which deployments are affected?

What should be prioritized for remediation?