CVE-2026-123783

Summary

Skyvern versions through 1.0.56 suffer from a sandbox escape vulnerability (CWE-184) where authenticated users can bypass AST-based denylists by reconstructing functions from raw bytecode using types.CodeType, enabling arbitrary code execution on the server. This allows attackers to import and use restricted modules like subprocess or socket despite sandbox restrictions.

Exploitability

Exploitation requires valid authentication and knowledge of Python internals to craft bytecode that evades AST-based checks, making it moderately difficult but feasible for skilled attackers.

Blast radius

Successful exploitation grants full server compromise with confidentiality, integrity, and availability impact, potentially enabling lateral movement, data exfiltration, or infrastructure takeover.

Detection

Defenders should monitor for anomalous subprocess or socket module imports in Python execution logs, especially when triggered by authenticated users via API endpoints handling script execution; look for log entries containing 'types.CodeType' usage or unexpected AST node patterns during script validation.

Prioritized remediation

Upgrade to Skyvern version 1.0.57 or later, which patches the sandbox bypass by blocking reconstruction of functions from raw bytecode.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.