Skyvern's Agent Sandbox Escape Got a CVE 53 Days After the Fix

A sandbox escape in Skyvern, the self-hosted agent that drives a web browser from LLM-generated steps, was assigned CVE-2026-82447 and published to the GitHub Advisory Database on 29 August 2026 at 15:30:19 UTC. The code fix it describes landed in the repository on 6 July at 21:44:03 UTC — 53 days earlier.

What the bug actually was

Skyvern's TextPromptBlock rendered every prompt twice. The first pass went through Jinja's SandboxedEnvironment, as intended. The second pass ran the same attacker-influenced string through an unsandboxed renderer, which is enough to execute code as the server process. The fix, commit d723de6, is a deletion: three lines added and eleven removed in block.py, dropping the second render and the parameter_values argument that fed it. The rest of the commit is tests.

Where the framing goes wrong

Two things get said about advisories like this that are not true here. The first is that it was a silent patch. It was not: the v1.0.45 release notes, published 7 July at 22:19:18 UTC, do contain the word "SSTI". But that is a single bullet in a release body running to roughly 190 lines, with no vendor security advisory, no CVE at the time, and nothing to distinguish it from routine changelog traffic. The second is the implication that a CVE year tells you when you were exposed. It does not — the CVE was raised by VulnCheck as a third-party numbering authority, not by the project.

The part that breaks tooling

The advisory record carries a CVSS 3.1 score of 8.8 and a CVSS 4.0 score of 8.7, and is classified CWE-1336. But its structured vulnerabilities array is empty. The affected range — 0.2.1 up to but excluding 1.0.45 — exists only as prose on VulnCheck's page. Any scanner that reads GitHub's structured advisory data and checks a pinned skyvern dependency against it will report nothing at all.

Why this shape keeps recurring

The exploit path is not an exotic one. A workflow parameter, or the output of an upstream block, is text the agent itself produced or ingested; it reaches a template renderer; it becomes code on the agent's host. That is the prompt-injection-to-execution bridge in its plainest form, and it is structural to tools that let a model's output steer a templating layer.