CVE-2025-49619: Skyvern SSTI RCE Vulnerability

CVE-2025-49619 Overview

CVE-2025-49619 is a server-side template injection (SSTI) vulnerability in Skyvern, an open-source browser automation platform. Versions through 0.1.85 fail to sanitize Jinja2 template syntax submitted through the Prompt field of workflow blocks, including the Navigation v2 Block. Authenticated users can inject crafted template expressions that the server evaluates, resulting in blind remote code execution (RCE). The flaw is tracked under [CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine].

Critical Impact
Authenticated attackers can achieve blind RCE on the Skyvern server through Jinja2 template injection in workflow prompt fields, exposing the host process and downstream automation infrastructure.

Affected Products

Skyvern versions up to and including 0.1.85
Workflow blocks accepting Prompt input, including the Navigation v2 Block
Self-hosted Skyvern deployments exposing the workflow API to authenticated users

Discovery Timeline

2025-06-07 - CVE-2025-49619 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-49619

Vulnerability Analysis

Skyvern uses the Jinja2 templating engine to render dynamic content inside workflow block Prompt fields. The application passes user-supplied strings directly into the Jinja2 environment without restricting access to dangerous attributes or sandboxing evaluation. An authenticated user can submit payloads such as {{ ... }} expressions that traverse Python object internals through attributes like __class__, __mro__, and __subclasses__ to reach OS command execution primitives. Because the rendered output is not always returned to the client, attackers rely on blind techniques such as time delays, DNS callbacks, or out-of-band HTTP requests to confirm execution. The Exploit-DB entry #52335 and the CristiBTZ technical write-up document working proof-of-concept payloads. The EPSS probability of 13.45% (95.94 percentile) reflects active interest from threat actors.

Root Cause

The root cause is the use of an unsandboxed Jinja2 Environment to render attacker-controlled input from workflow Prompt fields. Skyvern did not filter template metacharacters or restrict attribute access, allowing arbitrary Python expression evaluation. The upstream fix is committed in Skyvern commit db856cd.

Attack Vector

An authenticated user creates or edits a workflow and supplies a Jinja2 payload in the Prompt field of a vulnerable block such as Navigation v2. When the workflow executes, Skyvern renders the template server-side and evaluates the malicious expression. The attacker chains Python object introspection to invoke os.system or subprocess.Popen, exfiltrating data over DNS or HTTP because the execution channel is blind. The attack requires only low-privilege authentication and no user interaction, and the scope changes because the compromised process can act on other tenants and connected systems.

No verified exploit code is reproduced here. Refer to the CristiBTZ research post and Exploit-DB #52335 for sanitized payload details.

Detection Methods for CVE-2025-49619

Indicators of Compromise

Workflow definitions containing Jinja2 metacharacters such as {{, }}, {%, or attribute chains referencing __class__, __mro__, __subclasses__, or __globals__ in Prompt fields.
Outbound DNS lookups or HTTP requests from the Skyvern server to attacker-controlled domains shortly after workflow execution.
Unexpected child processes spawned by the Skyvern Python interpreter, including shells, curl, wget, or nslookup.

Detection Strategies

Inspect Skyvern application and database records for workflow blocks whose Prompt field contains Jinja2 expression delimiters or Python dunder attributes.
Correlate workflow execution events with process creation telemetry on the Skyvern host to surface anomalous child processes.
Monitor egress traffic from the Skyvern server for callbacks to interactsh, Burp Collaborator, or unfamiliar resolver domains.

Monitoring Recommendations

Enable verbose audit logging on the Skyvern API to capture workflow create and update operations along with the submitted Prompt content.
Alert on first-time outbound connections from the Skyvern service account to new domains or IP ranges.
Baseline normal child-process behavior of the Skyvern container or service and alert on deviations such as shell invocations.

How to Mitigate CVE-2025-49619

Immediate Actions Required

Upgrade Skyvern to a version that includes commit db856cd, which removes the unsafe Jinja2 rendering path.
Audit existing workflows for malicious Prompt payloads and remove or quarantine any unrecognized template expressions.
Rotate credentials, API tokens, and cloud keys accessible to the Skyvern process, since blind RCE may already have exposed them.

Patch Information

The Skyvern maintainers addressed the issue in the public repository through commit db856cd8433a204c8b45979c70a4da1e119d949d. Operators running version 0.1.85 or earlier should pull a release that incorporates this commit and redeploy. Confirm the patched version by reviewing the rendering logic for workflow Prompt fields.

Workarounds

Restrict Skyvern access to trusted administrators while patching, since exploitation requires authentication.
Run Skyvern in a hardened container with no outbound internet access and a read-only filesystem to limit blind exfiltration and persistence.
Apply egress firewall rules that allow only the destinations required for legitimate automation targets.

bash

# Example egress restriction using iptables on the Skyvern host
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p tcp -d <allowed-target-ip> --dport 443 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -d <internal-resolver> -j ACCEPT
iptables -A OUTPUT -j DROP