EUVD-2026-118301
GHSA-2555-vffj-g73c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Skyvern as script-authoring user
-
ExploitCraft script reconstructing a function via types.CodeType bytecode
-
ExecutionBypass is_safe_script_code AST denylist, import subprocess/socket
-
ImpactExecute arbitrary code in Skyvern server process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation completeness
|
| Exploitation Conditions | Requires an authenticated Skyvern user (PR:L) with the ability to submit or deploy workflow script code blocks that the server executes. The concrete trigger named in the description is reconstructing a function from raw bytecode via types.CodeType, which evades the AST-based is_safe_script_code denylist in code_block_safety.py and permits importing otherwise-blocked modules such as subprocess or socket to run code in the Skyvern server process. Limiting factors: exploitation is confined to Skyvern versions through 1.0.56, needs authenticated script-authoring privileges rather than anonymous access, and requires no user interaction; risk is materially higher in multi-tenant or untrusted-user deployments and much lower where only trusted operators can author scripts. |
| Impact | This is a credible, near-term priority for anyone running Skyvern that lets more than fully-trusted operators author or run workflow scripts, but it is not an unauthenticated internet-wide emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack with no user interaction but requiring low-level authentication (PR:L), yielding high confidentiality, integrity and availability impact on the Skyvern server process (VC:H/VI:H/VA:H), with no subsequent-system scope change claimed (SC/SI/SA:N). The vuln.today decision label is this_week and the vendor-shipped patch (PR #8937 / commit 31a64c1) is available, both consistent with a serious-but-gated issue rather than act_now/emergency. No EPSS score and no KEV listing were provided in the input, and there is no confirmed working-exploit artifact - so there is no signal of mass or automated exploitation; however, the technique is described in detail by VulnCheck's advisory and the public GitHub issue #8927, lowering the research barrier. The dominant mitigating factor is the PR:L authentication requirement: real-world risk concentrates in multi-tenant or untrusted-user deployments where authenticated principals can submit scripts, and drops sharply in single-tenant installs where only trusted operators can author code. CWE-184 (incomplete denylist) fits precisely - the AST-level is_safe_script_code check was bypassable because it enumerated forbidden patterns rather than constraining capabilities. |
| Exploit ScenarioDerived | An authenticated Skyvern user who can author or deploy workflow script code blocks submits a script that reconstructs a function from raw bytecode using types.CodeType, which the AST-based is_safe_script_code denylist does not catch. The reconstructed code imports normally-blocked modules such as subprocess or socket and runs arbitrary commands inside the Skyvern server process. No public working exploit is identified in the input, but the mechanism is publicly documented in the VulnCheck advisory and GitHub issue #8927. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 06, 2026
Sandbox escape in Skyvern through 1.0.56 lets authenticated users who can author or deploy workflow code blocks run arbitrary Python inside the Skyvern server process. The AST-based denylist in code_block_safety.py can be sidestepped by rebuilding a function from raw bytecode with types.CodeType, after which otherwise-blocked modules such as subprocess or socket can be imported. Exploitation requires an authenticated account with script-authoring privileges (CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so risk is concentrated in multi-tenant or untrusted-user deployments; the issue is public via the upstream tracker and fix PR, though no public exploit code has been identified at time of analysis and KEV status is absent.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit 31a64c1a4b5dfaf1e76a7164845e10f2d68248dc or merge PR https://github.com/Skyvern-AI/skyvern/pull/8937 and rebuild, since the change spans code_block_safety.py, service.py, script_service.py and cleanup_service.py. The patch blocks the types and sys modules plus CodeType, FunctionType and LambdaType attributes, validates stored script sources at load time, and scopes generated-script temp paths by script_revision_id, so a partial backport of only the denylist additions leaves the load-time gate and stale-artifact path unaddressed. If patching must be deferred, restrict workflow script authoring and editing to fully trusted operators (the flaw needs an authenticated script-authoring account), and isolate Skyvern so that code running in its server process cannot reach sensitive credentials, cloud metadata endpoints or internal networks; note that this is containment only and does not close the sandbox escape itself. Also review existing workflow scripts for use of types/CodeType bytecode construction or unexpected subprocess/socket imports, since stored scripts written before the fix are re-validated only once the patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Skyvern executes user-authored Python 'code blocks' inside its own server process and relies on an AST-based denylist, is_safe_script_code, defined in skyvern/forge/sdk/workflow/code_block_safety.py (BLOCKED_ATTRS / ALLOWED_SCRIPT_ATTRS / BLOCKED_SCRIPT_ATTRS) to reject dangerous attribute access and module imports. The root cause class is CWE-184, Incomplete List of Disallowed Inputs: the denylist enumerates names but does not account for dynamic code construction, so a script can assemble a code object with types.CodeType from raw bytecode and obtain a callable without ever naming a blocked attribute or import in the AST that the checker inspects. Once that indirection succeeds, modules such as subprocess or socket, normally stripped by the denylist, can be pulled in and used to run commands in the Skyvern server process. The upstream fix (PR #8937 / commit 31a64c1a4b5dfaf1e76a7164845e10f2d68248dc) tightens the denylist by adding CodeType, FunctionType and LambdaType to the blocked attribute set and blocking the sys and types modules, and adds defense in depth on the execution path: _validate_stored_script_sources re-runs is_safe_script_code over every stored .py file in a revision before it is loaded, _load_user_script_module refuses to load when that validation fails, and generated-script artifacts are moved from TEMP_PATH/<script_id> to revision-scoped TEMP_PATH/<script_id>/<script_revision_id> so a stale cached copy from an earlier run cannot stand in for code that was not loaded for the current revision.
Know when Skyvern gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable workflow script submission with low-complexity denylist bypass requires an authenticated user (PR:L), and code runs within the same Skyvern server process (S:U) with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is_safe_script_code AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.
Articles & Coverage 1
Executive ViewAI
Skyvern, a workflow automation platform, contains a high-severity sandbox escape (CVE-2026-123783) that allows authenticated script authors to execute arbitrary code on the host. This puts multi-tenant or untrusted-user deployments at risk of full server compromise, enabling data theft, service disruption, and potential lateral movement. Leadership should prioritize patching because a public disclosure and fix now exist, increasing the likelihood of exploitation attempts.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB