Skyvern TextPromptBlock Sandbox Escape

Skyvern versions prior to 1.0.45 are susceptible to a critical sandbox escape vulnerability located within the TextPromptBlock component. This flaw originates from an insecure rendering process where prompts are processed twice: once within a secured, sandboxed Jinja environment and subsequently within an unsandboxed environment. This architectural oversight allows an attacker to supply malicious Jinja2 template syntax through workflow parameters or upstream block outputs. When the application processes these inputs, the second, unsandboxed rendering pass executes the injected code with the full privileges of the underlying server process. This vulnerability is significant as it provides a direct path to remote code execution (RCE) without requiring existing credentials, potentially granting an adversary persistent access to the server's filesystem and environment variables.

Impact

The vulnerability poses a severe risk to any organization deploying Skyvern for automated browser-based workflows. Successful exploitation enables unauthorized remote code execution, which can lead to complete server compromise, data exfiltration, or the deployment of additional malicious payloads. Organizations should prioritize patching to version 1.0.45 or higher immediately.

Recommendation

• Upgrade all Skyvern instances to version 1.0.45 or later to eliminate the double-rendering vulnerability in the TextPromptBlock component.
• Review existing automated workflows for inputs that interact with the TextPromptBlock; restrict access to these parameters where possible.
• Isolate the Skyvern server from internal sensitive networks and ensure the process runs with the least privilege necessary to mitigate the impact of a potential sandbox escape.