Skyvern CVE-2026-82447

Exploitation requires a valid authenticated Skyvern user account with permission to create or modify workflows (CVSS PR:L confirms low-privilege authentication). The attacker must specifically be able to control input that reaches a TextPromptBlock - either directly through workflow parameter definitions or indirectly through the output of an upstream workflow block whose results are interpolated into the TextPromptBlock prompt. Skyvern versions 1.0.45 and later are not exploitable due to the architectural fix. Limiting factors: a valid user account is mandatory (unauthenticated exploitation is not possible per PR:L); the target workflow must use TextPromptBlock with externally-influenced parameters; and exploitation is scoped to deployments running Skyvern before 1.0.45. No special OS configuration, non-default feature flag, or specific network topology is required beyond reachability to the Skyvern instance.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H is consistent with the actual exploitation profile: network-reachable, no special attack conditions, low-privilege authentication required, and full confidentiality, integrity, and availability impact on the vulnerable system. PR:L is the primary mitigating factor - exploitation is gated on possessing a valid workflow user account. The vulnerability is not in CISA KEV and no dedicated POC has been identified in the provided data; however, generic Jinja2 SSTI-to-RCE techniques are publicly well-understood and require no specialized knowledge, effectively lowering the practical exploitation barrier for authenticated users. EPSS data was not provided in the input. The SC:N/SI:N/SA:N in the CVSS 4.0 base vector suggests the reporter assessed no cross-system scope change, though server-process RCE realistically enables lateral movement and host-level compromise beyond the Skyvern process itself - defenders should treat the blast radius as broader than the base vector implies.

An attacker with a low-privilege Skyvern user account creates or modifies a workflow containing a TextPromptBlock, injecting a Jinja2 class-traversal payload such as {{ ''.__class__.__mro__[1].__subclasses__()[-1]('id', shell=True).communicate()[0] }} into a workflow parameter. When the workflow executes, the payload survives the first sandboxed render and is re-evaluated verbatim in the unsandboxed load_prompt_from_string call, executing the OS command with the privileges of the Skyvern server process. No dedicated public exploit code has been identified at time of analysis, but exploitation follows standard Jinja2 SSTI techniques that are widely published.