---
id: CVE-2026-82447
title: >-
  Skyvern before 1.0.45 contains a sandbox escape vulnerability in
  TextPromptBlock that renders prompts twice, first through a sandboxed Jinja
  environment and then through an unsandboxed environment
summary: >-
  Skyvern before 1.0.45 contains a sandbox escape vulnerability in
  TextPromptBlock that renders prompts twice, first through a sandboxed Jinja
  environment and then through an unsandboxed environment. Attackers can inject
  malicious Jinja te…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-1336
published: '2026-08-29'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:46.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82447'
references:
  - url: 'https://github.com/Skyvern-AI/skyvern'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Skyvern-AI/skyvern/blob/v1.0.44/skyvern/forge/sdk/prompting.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Skyvern-AI/skyvern/blob/v1.0.44/skyvern/forge/sdk/workflow/models/block.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Skyvern-AI/skyvern/commit/d723de621d5b3a340f3cc4d5b46bfe40a9a3124e
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/skyvern-before-1.0.45-sandbox-escape-via-textpromptblock
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00775
epssPercentile: 0.53897
ingestedAt: '2026-08-30T07:49:08.340Z'
vendor: Skyvern-AI
product: skyvern
affected:
  - skyvern >= 0.2.1 < 1.0.45
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-01T02:06:30.299334Z'
---

## Overview

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.