PT-2026-83426
CVE-2026-82447
·
تاريخ النشر
2026-08-29
·
تاريخ التحديث
2026-09-01
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Skyvern versions prior to 1.0.45
Description
A sandbox escape exists in the
TextPromptBlock component. The issue occurs because prompts are rendered twice: first within a sandboxed Jinja environment and subsequently through an unsandboxed environment. This allows attackers to inject malicious Jinja template syntax via workflow parameters or upstream block output to execute arbitrary code with server process privileges.Recommendations
Update Skyvern to version 1.0.45 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾