---
id: CVE-2025-49619
aliases:
  - GHSA-h92g-3xc3-ww2r
  - PYSEC-2026-1929
title: Skyvern has a Jinja runtime leak
summary: Skyvern has a Jinja runtime leak
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
vendor: skyvern
product: skyvern
ecosystem: pip
affected:
  - skyvern <= 0.2.0
published: '2025-06-07'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-h92g-3xc3-ww2r'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-49619'
  - url: >-
      https://github.com/Skyvern-AI/skyvern/commit/db856cd8433a204c8b45979c70a4da1e119d949d
  - url: 'https://cristibtz.blog/posts/CVE-2025-49619'
  - url: 'https://cristibtz.github.io/posts/CVE-2025-49619'
  - url: 'https://github.com/Skyvern-AI/skyvern'
  - url: 'https://www.exploit-db.com/exploits/52335'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.19972
epssPercentile: 0.97348
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:50.025Z'
exploits:
  exploitdb: true
  github: 1
  githubRepos:
    - 'https://github.com/cristibtz/CVE-2025-49619'
  metasploit:
    - exploit/linux/http/skyvern_ssti_cve_2025_49619
  checkedAt: '2026-09-26T09:05:33.855Z'
---

## Overview

Skyvern through 0.2.0 has a Jinja runtime leak in sdk/workflow/models/block.py.

## Affected packages

- `skyvern <= 0.2.0`

## Remediation

Refer to the advisory for the patched release.