CVE-2026-82447: Skyvern Sandbox Escape RCE Vulnerability

CVE-2026-82447 Overview

CVE-2026-82447 is a sandbox escape vulnerability in Skyvern versions before 1.0.45. The flaw resides in the TextPromptBlock component, which renders prompts twice: first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers with workflow access can inject malicious Jinja template syntax through workflow parameters or upstream block output. Successful exploitation executes arbitrary code with the privileges of the Skyvern server process. The issue is categorized under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), commonly referred to as Server-Side Template Injection (SSTI).

Critical Impact
Authenticated attackers can execute arbitrary code on the Skyvern server, leading to full compromise of the host process and any data or credentials it can access.

Affected Products

Skyvern (Skyvern-AI) versions prior to 1.0.45
Workflows using the TextPromptBlock component
Deployments accepting untrusted workflow parameters or upstream block outputs

Discovery Timeline

2026-08-29 - CVE-2026-82447 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82447

Vulnerability Analysis

Skyvern is an AI-driven browser automation platform that uses Jinja templates to compose prompts sent to language models. The TextPromptBlock class implemented a two-pass rendering strategy for template resolution. The first pass used a sandboxed Jinja environment intended to safely resolve user-supplied variables. The second pass re-rendered the resulting string through an unsandboxed Jinja environment. Because the first pass emits attacker-controlled text as-is, any Jinja syntax injected into workflow parameters or upstream block outputs survives into the unsandboxed pass and is evaluated with full access to Python built-ins.

Root Cause

The root cause is duplicate rendering across trust boundaries. Sandboxing only the first render provides no protection when the second render lacks equivalent restrictions. Jinja's unsandboxed environment permits access to attribute chains such as __class__.__mro__ and __subclasses__(), which are common paths to arbitrary Python execution. Any string reaching the second render effectively bypasses the sandbox.

Attack Vector

Exploitation requires low privileges and network access to a workflow interface. An attacker submits Jinja template payloads through workflow parameters, upstream block outputs, or any input field consumed by TextPromptBlock. When the block executes, the injected syntax is evaluated in the unsandboxed pass, producing code execution under the Skyvern server process account. Relevant source files are prompting.py and block.py.

python

    async def send_prompt(
        self,
        prompt: str,
-        parameter_values: dict[str, Any],
        workflow_run_id: str,
        organization_id: str | None = None,
        workflow_run_block_id: str | None = None,

Source: GitHub Commit d723de6 — the patch removes the non-sandboxed second render in TextPromptBlock, eliminating the SSTI path by dropping the parameter_values re-rendering argument.

Detection Methods for CVE-2026-82447

Indicators of Compromise

Workflow parameters or block outputs containing Jinja syntax such as {{, {%, __class__, __mro__, or __subclasses__.
Unexpected child processes spawned by the Skyvern server process (for example sh, bash, python -c, curl, wget).
Outbound network connections from the Skyvern host to attacker-controlled infrastructure shortly after workflow execution.
Skyvern application logs showing template rendering errors or unusual prompt content in TextPromptBlock executions.

Detection Strategies

Inspect stored workflow definitions and parameter values for template metacharacters and Python dunder attribute references.
Correlate workflow execution events with process creation and network telemetry on Skyvern hosts.
Deploy signatures for common SSTI payloads targeting Jinja, including access to config, cycler, and lipsum globals.

Monitoring Recommendations

Alert on Skyvern service processes spawning shells or interpreters that are not part of normal automation flows.
Monitor egress connections from Skyvern hosts and flag traffic to non-approved destinations.
Enable verbose audit logging on workflow creation and modification events, and retain them in a centralized data lake.

How to Mitigate CVE-2026-82447

Immediate Actions Required

Upgrade Skyvern to version 1.0.45 or later, which removes the unsandboxed second render.
Restrict access to Skyvern workflow creation and editing to trusted, authenticated users only.
Audit existing workflows for suspicious Jinja syntax in TextPromptBlock parameters and upstream block outputs.
Rotate any credentials, API keys, or tokens accessible to the Skyvern server process if compromise is suspected.

Patch Information

The fix is delivered in Skyvern 1.0.45 via commit d723de6, which removes the non-sandboxed second render from TextPromptBlock.send_prompt. Additional context is available in the VulnCheck Security Advisory and the Skyvern GitHub repository.

Workarounds

If patching is not immediately possible, disable use of TextPromptBlock in workflows exposed to untrusted input.
Enforce strict input validation on workflow parameters to reject Jinja metacharacters ({{, }}, {%, %}).
Run the Skyvern server under a dedicated low-privilege service account with restricted filesystem and network access.
Place Skyvern behind an authenticated reverse proxy and restrict workflow APIs to trusted networks.

bash

# Upgrade Skyvern to the patched release
pip install --upgrade 'skyvern>=1.0.45'

# Verify installed version
python -c "import skyvern; print(skyvern.__version__)"