Executive brief
Skyvern is an automation platform that uses AI to execute browser-based workflows. A vulnerability in the TextPromptBlock component causes workflow prompts to be rendered twice—once through a restricted sandbox, then again without restrictions—allowing attackers to inject malicious template code through workflow parameters and execute arbitrary code on the server.
Technical details
The vulnerability is a template injection flaw in the TextPromptBlock component. Prompts are rendered twice: first through a sandboxed Jinja2 environment (which should restrict dangerous operations), and then through an unsandboxed environment that removes protections. An attacker can craft workflow parameters or poison upstream block output with Jinja template syntax that escapes the first sandbox and executes arbitrary code during the second, unrestricted render pass. This requires network access to submit a malicious workflow but does not require prior authentication. Successful exploitation grants the attacker code execution with server process privileges. The fix was implemented in version 1.0.45 and later.
Affected products
- Skyvern-AI Skyvern before 1.0.45
Timeline
- 2026-08-29: disclosed