Skyvern before version 1.0.45 contains a sandbox escape flaw in the TextPromptBlock component. The vulnerability causes user supplied template fragments to be rendered twice—first within a restricted Jinja environment intended to prevent code execution, and then again in an unsandboxed environment. This double rendering allows an attacker to inject malicious Jinja template syntax via workflow parameters or the output of upstream blocks. When interpreted by the unsandboxed engine, the injected syntax can execute arbitrary code with the full privileges of the server process. The weakness is a form of template forging identified as CWE‑1336 and can lead to complete compromise of the hosting machine.

The affected product is Skyvern AI’s Skyvern platform before release 1.0.45. Any deployment of Skyvern contained within that version range is vulnerable; versions 1.0.45 and later are considered fixed.

The severity represented by a CVSS score of 8.7 indicates high risk. While a precise EPSS value is not available, the vulnerability permits code execution without additional authentication, implying a high likelihood of exploitation if an attacker can influence the workflow inputs. The flaw is not listed in the CISA KEV catalog, but its impact and ease of exploitation recommend prompt mitigation. Attackers would typically craft malicious workflow parameters or upstream outputs that include Jinja syntax, then trigger execution of the TextPromptBlock. The ability to execute code at the server level provides full control of the affected environment.