Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is safe script code AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.