A critical sandbox escape vulnerability in the TextPromptBlock component of Skyvern allows authenticated attackers to achieve remote code execution on the underlying server.

The vulnerability exists because the TextPromptBlock processes input twice, first through a secure sandboxed Jinja environment and then through an unsandboxed environment. An authenticated attacker can leverage this flaw by injecting malicious Jinja template syntax into workflow parameters or upstream block outputs to bypass security controls and execute arbitrary code.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands with the privileges of the Skyvern server process. This could lead to full system compromise, unauthorized access to sensitive workflow data, or the potential for lateral movement within the network. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk that requires immediate attention to prevent operational disruption and data breaches.

Immediate Action: Update the Skyvern installation to version 1.0.45 or later, which contains the necessary security fixes to ensure all templates are processed within a secure environment.

Proactive Monitoring: Review application and system logs for unusual Jinja template activity or unexpected system command execution patterns. Monitor workflow execution logs for input parameters containing suspicious characters or template syntax.

Compensating Controls: Implement strict input validation on all workflow parameters and upstream block outputs to filter out potential malicious template syntax. Utilize network segmentation to limit the reach of the Skyvern server in the event of a compromise.

Public Exploit Available: Unknown

Organizations utilizing Skyvern must prioritize upgrading to version 1.0.45 immediately to remediate this sandbox escape vulnerability. The ability for an attacker to execute arbitrary code via template injection poses a significant threat to the integrity and confidentiality of the environment, necessitating a swift transition to the patched version.