{"id":"CVE-2026-123783","published":"2026-11-06T15:17:21.103","lastModified":"2026-11-06T18:18:04.953","description":"Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is_safe_script_code AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-184"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Skyvern-AI/skyvern","tags":[]},{"url":"https://github.com/Skyvern-AI/skyvern/blob/v1.0.56/skyvern/forge/sdk/workflow/code_block_safety.py#L106-L142","tags":[]},{"url":"https://github.com/Skyvern-AI/skyvern/blob/v1.0.56/skyvern/forge/sdk/workflow/service.py#L1509-L1511","tags":[]},{"url":"https://github.com/Skyvern-AI/skyvern/commit/31a64c1a4b5dfaf1e76a7164845e10f2d68248dc","tags":[]},{"url":"https://github.com/Skyvern-AI/skyvern/issues/8927","tags":[]},{"url":"https://github.com/Skyvern-AI/skyvern/pull/8937","tags":[]},{"url":"https://www.vulncheck.com/advisories/skyvern-through-1.0.56-script-sandbox-bypass-via-types-codetype-bytecode","tags":[]}],"exploitRefs":[{"url":"https://github.com/Skyvern-AI/skyvern","tags":[]},{"url":"https://github.com/Skyvern-AI/skyvern/blob/v1.0.56/skyvern/forge/sdk/workflow/code_block_safety.py#L106-L142","tags":[]},{"url":"https://github.com/Skyvern-AI/skyvern/blob/v1.0.56/skyvern/forge/sdk/workflow/service.py#L1509-L1511","tags":[]},{"url":"https://github.com/Skyvern-AI/skyvern/commit/31a64c1a4b5dfaf1e76a7164845e10f2d68248dc","tags":[]},{"url":"https://github.com/Skyvern-AI/skyvern/issues/8927","tags":[]},{"url":"https://github.com/Skyvern-AI/skyvern/pull/8937","tags":[]}],"hasPoc":true,"ai":{"summary":"Skyvern versions through 1.0.56 suffer from a sandbox escape vulnerability (CWE-184) where authenticated users can bypass AST-based denylists by reconstructing functions from raw bytecode using types.CodeType, enabling arbitrary code execution on the server. This allows attackers to import and use restricted modules like subprocess or socket despite sandbox restrictions.","exploitability":"Exploitation requires valid authentication and knowledge of Python internals to craft bytecode that evades AST-based checks, making it moderately difficult but feasible for skilled attackers.","blast_radius":"Successful exploitation grants full server compromise with confidentiality, integrity, and availability impact, potentially enabling lateral movement, data exfiltration, or infrastructure takeover.","remediation":"Upgrade to Skyvern version 1.0.57 or later, which patches the sandbox bypass by blocking reconstruction of functions from raw bytecode.","detection":"Defenders should monitor for anomalous subprocess or socket module imports in Python execution logs, especially when triggered by authenticated users via API endpoints handling script execution; look for log entries containing 'types.CodeType' usage or unexpected AST node patterns during script validation.","tags":["rce","sandbox-bypass","python","auth-bypass","code-execution"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:51:03.735Z"}}