Skip to content
Heist/ feed
Back to feed
High

Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock

Type: advisorySources: OSV

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-82447
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 03:36 UTC · Revision 1

Source evidence

Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock

core-osv · Original source

Published 29 Aug 2026, 12:05 UTC

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.

osv:CVE-2026-82447
Complete source record
{
  "id": "4d162ea875dea097415154721f884f511ae3946f01b62e65df1cb2c49daeb2ff",
  "url": "https://osv.dev/vulnerability/CVE-2026-82447",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock",
    "summary": "Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.",
    "evidence": "osv:CVE-2026-82447",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-82447",
      "aliases": [
        "CVE-2026-82447"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/skyvern-ai/skyvern",
              "type": "GIT",
              "events": [
                {
                  "introduced": "99c7792c2186ed62e3ce0ac54d2fd7bf3e8bad1f"
                },
                {
                  "fixed": "632b8ec501c1c68453300230849f1f4a05462477"
                },
                {
                  "fixed": "d723de621d5b3a340f3cc4d5b46bfe40a9a3124e"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0.2.1"
                      },
                      {
                        "fixed": "1.0.45"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "d723de621d5b3a340f3cc4d5b46bfe40a9a3124e"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.0.44",
            "v1.0.43",
            "v1.0.42",
            "v1.0.41",
            "v1.0.40",
            "v1.0.39",
            "v1.0.38",
            "v1.0.37",
            "v1.0.36",
            "v1.0.35",
            "v1.0.34",
            "v1.0.33",
            "v1.0.32",
            "v1.0.31",
            "v1.0.30",
            "v1.0.29",
            "v1.0.28",
            "v1.0.27",
            "v1.0.26",
            "v1.0.25",
            "v1.0.24",
            "v1.0.23",
            "v1.0.22",
            "v1.0.21",
            "v1.0.20",
            "v1.0.19",
            "v1.0.18",
            "v1.0.17",
            "v1.0.16",
            "v1.0.15",
            "v1.0.14",
            "v1.0.13",
            "v1.0.12",
            "v1.0.11",
            "v1.0.10",
            "v1.0.9",
            "v1.0.8",
            "v1.0.7",
            "v1.0.6",
            "v1.0.5",
            "v1.0.4",
            "v1.0.3",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0",
            "v0.2.23",
            "v0.2.22",
            "v0.2.21",
            "v0.2.20",
            "v0.2.19",
            "v0.2.18",
            "v0.2.17",
            "v0.2.16",
            "v0.2.15",
            "v0.2.14",
            "v0.2.13",
            "v0.2.12",
            "v0.2.11",
            "v0.2.10",
            "v0.2.9",
            "v0.2.8",
            "v0.2.7",
            "v0.2.6",
            "v0.2.5",
            "v0.2.4",
            "v0.2.3",
            "v0.2.2",
            "v0.2.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82447.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:33.097822060Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82447.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-82447",
        "https://www.vulncheck.com/advisories/skyvern-before-1.0.45-sandbox-escape-via-textpromptblock",
        "https://github.com/Skyvern-AI/skyvern/commit/d723de621d5b3a340f3cc4d5b46bfe40a9a3124e",
        "https://github.com/Skyvern-AI/skyvern",
        "https://github.com/Skyvern-AI/skyvern/blob/v1.0.44/skyvern/forge/sdk/prompting.py",
        "https://github.com/Skyvern-AI/skyvern/blob/v1.0.44/skyvern/forge/sdk/workflow/models/block.py"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-1336"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82447.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-82447",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 500050,
  "published_at": "2026-08-29T12:05:34.113+00:00"
}