CVE-2026-82447: Improper Neutralization of Special Elements Used in a Template Engine in Skyvern-AI skyvern

Skyvern versions from 0.2.1 up to but not including 1.0.45 contain a vulnerability in the TextPromptBlock where prompts are rendered twice—initially in a sandboxed Jinja environment and subsequently in an unsandboxed environment. This improper neutralization of special elements used in the template engine allows attackers to inject malicious Jinja template syntax through workflow parameters or upstream block output. Successful exploitation results in arbitrary code execution with server process privileges.

An attacker can execute arbitrary code on the server running the vulnerable Skyvern instance, potentially leading to full compromise of the server process. This elevates the risk of unauthorized access, data theft, or disruption of service. The CVSS 4.0 score of 8.7 (high severity) reflects the network attack vector, low attack complexity, no required privileges beyond limited user privileges, and no user interaction needed.

A fixed version of Skyvern is available starting from version 1.0.45. Users should upgrade to version 1.0.45 or later to remediate this vulnerability. No additional mitigation steps are indicated in the provided data.