Skyvern through 1.0.56 contains a sandbox bypass that lets authenticated users run arbitrary code. By reconstructing functions from raw bytecode using types.CodeType, an attacker can create scripts that slip past the is_safe_script_code AST denylist and import modules such as subprocess or socket, allowing code to execute in the Skyvern server process. This grants the attacker full control over the execution environment with the privileges of the authenticated user.

Skyvern Ltd.’s Skyvern platform, version 1.0.56, is affected. The issue arises in the outbound script execution engine provided by the SDK, as described in the source code files. Any deployment of this version that allows authenticated users to submit or trigger custom Python scripts is vulnerable. Versions prior to 1.0.56 or later patched releases are not affected.

The vulnerability has a CVSS score of 8.7, indicating high severity. The EPSS score is not available, so the exploitation probability cannot be quantified, but the absence of a KEV listing suggests that publicly known exploits are not yet present. The likely attack path requires an authenticated user to submit a malicious script; therefore, the vector is internal or network access for valid users. Once the bytecode trick is applied, the attacker can execute arbitrary code on the server.