Description

Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is_safe_script_code AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-06T15:17:21.103Z",
  "pubdate": "2026-11-06T15:17:21.103Z",
  "executiveSummary": "A sandbox bypass vulnerability exists in Skyvern through version 1.0.56, allowing authenticated users to achieve arbitrary code execution within the context of the host server process. The application utilizes an Abstract Syntax Tree (AST) denylist mechanism, specifically implemented via the is_safe_script_code function, to inspect and restrict submitted script code. However, this static security control can be bypassed by leveraging raw Python bytecode manipulation.\nBy instantiating function objects dynamically using types.CodeType, an authenticated attacker can execute arbitrary bytecode payloads that circumvent static syntax analysis. This technique enables script authors to bypass import restrictions and load blocked standard library modules, including subprocess and socket, directly inside the running Skyvern application process. Successful exploitation allows an attacker to execute arbitrary commands, interact with network services, and compromise the host environment under the operational privileges of the Skyvern server.",
  "technicalDetails": "The vulnerability manifests in Skyvern through version 1.0.56 due to inadequate sandboxing mechanisms applied to user-supplied executable scripts. To prevent unauthorized or malicious operations from executing on the host server, Skyvern relies on an Abstract Syntax Tree (AST) denylist filter implemented via the is_safe_script_code function. This validation routine parses submitted script source code into an AST representation and inspects syntax nodes to detect and block forbidden operations, such as explicit module import statements or calls to dangerous built-in functions.\nThe root cause of the vulnerability stems from the fundamental limitation of static AST analysis when decoupled from strict runtime execution controls. Python permits the dynamic instantiation of executable code objects at runtime through the types.CodeType class, which accepts raw bytecode instruction sequences, constant tables, and variable name lists to fabricate a callable function. Because the static parser in is_safe_script_code evaluates high-level syntax nodes prior to execution, it fails to inspect or analyze the internal instruction stream contained within raw bytecode structures passed to types.CodeType.\nExploitation proceeds through the following sequential attack flow:\n1. Authentication and Access: An authenticated attacker accesses the Skyvern application functionality responsible for accepting and executing custom user scripts.\n2. Payload Assembly: The attacker prepares a Python script intended to execute privileged actions, such as spawning shell processes or opening socket interfaces, and extracts its raw compiled bytecode representation.\n3. AST Filter Evasion: The attacker submits a script that encodes the raw bytecode and calls types.CodeType to reconstruct the compiled payload function. Because the source code lacks explicit high-level import keywords or blacklisted AST node structures, the is_safe_script_code denylist check evaluates the script as safe.\n4. Dynamic Instantiation: Upon execution, Skyvern passes the script to the interpreter. The script executes the types.CodeType call, synthesizing a new executable function directly from the embedded bytecode payload.\n5. Module Import and Escape: The newly instantiated function runs within the active Python runtime context of the Skyvern server process. It dynamically imports restricted standard modules, such as subprocess for command execution or socket for network communications.\n6. Impact and Privilege Level: The executed payload runs directly within the host Skyvern process, granting the attacker the ability to perform arbitrary actions with the full file system, memory, and network permissions of the server process."
}