Description

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-29T13:16:38.643Z",
  "pubdate": "2026-08-29T13:16:38.643Z",
  "executiveSummary": "Skyvern versions prior to 1.0.45 contain a critical sandbox escape vulnerability located within the TextPromptBlock component. This flaw facilitates Remote Code Execution (RCE) by leveraging a double-rendering vulnerability in the Jinja2 template engine process.\nThe vulnerability occurs because prompt data is processed sequentially through a restricted, sandboxed Jinja environment followed by an unsandboxed, unfiltered rendering pass. An attacker capable of influencing workflow parameters or providing malicious upstream block outputs can inject arbitrary Jinja2 template syntax. This syntax is subsequently executed with the privileges of the server process, effectively bypassing intended security controls.\nThe impact of this vulnerability is severe, as it allows for full server-side command execution, potentially leading to total system compromise, unauthorized data access, and further lateral movement within the network. Exploitation does not require prior authentication if the vulnerable inputs are exposed via public-facing workflows. Users are advised to upgrade to version 1.0.45 or later immediately to remediate the flaw.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of template rendering within the TextPromptBlock component of Skyvern. The application design implements a two-stage rendering process for prompts: an initial pass intended to sanitize input using a restricted Jinja2 environment, followed by a secondary, unconstrained rendering pass.\nDuring the exploitation process, an attacker injects malicious Jinja2 template expressions (e.g., using double curly brace syntax {{ ... }}) into workflow parameters or output fields from preceding nodes in the automation chain. When the TextPromptBlock processes this input, the initial sandboxed pass fails to neutralize the malicious syntax or inadvertently serializes it in a manner that remains valid for the second pass.\nThe subsequent, unsandboxed rendering pass executes the injected payload within the context of the server process. Because this secondary execution lacks the restrictions imposed on the initial environment, the injected Jinja2 expressions gain access to the underlying Python environment. This allows attackers to invoke powerful built-in functions, access internal objects, and execute arbitrary system-level commands through Python’s subprocess module or similar primitives.\nThe attack flow is as follows: 1) The attacker identifies a workflow parameter or upstream block output that flows into the TextPromptBlock. 2) The attacker submits a crafted payload containing Jinja2 template tags designed to perform system-level operations. 3) Skyvern executes the first rendering stage, which fails to correctly identify or block the injected syntax. 4) The secondary render engine processes the output, resulting in the interpretation and execution of the malicious template code. 5) The server processes the command with elevated privileges, leading to unauthorized code execution.\nThis vulnerability is particularly critical because it bypasses the security boundaries established by the sandbox. The lack of strict separation between the input handling and the final template evaluation engine means that even limited user inputs can be weaponized if those inputs are treated as template variables in a multi-pass render cycle.\nThe vulnerability affects all Skyvern versions prior to 1.0.45. Exploitation requires no specific authentication if the workflow entry point is exposed, and the post-exploitation impact is complete system takeover, allowing for persistent unauthorized access, data exfiltration, and potential compromise of the local infrastructure hosting the Skyvern instance."
}