CVE-2026-123783 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Skyvern, an AI browser automation tool, has a sandbox escape in its script runner: authenticated users can rebuild functions from raw bytecode to evade the AST denylist. A successful attacker runs arbitrary code inside the Skyvern server process, including importing blocked modules like subprocess and socket.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Skyvern and let users, including low-privilege accounts, deploy or run scripts. The flaw needs an authenticated account and the script execution feature. Instances where only trusted operators can log in and no script deployment is exposed carry lower risk, but the patch still applies.
Not affected if auth-required, managed-hosting, no-user-scripts
Who cares ai-browser-automation, python, self-hosted, skyvern
1.0.56)1.0.56 (the fixed version is not stated in the sources; see the linked patch)Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is_safe_script_code AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.