{"id":"CVE-2026-123783","kind":"vulnerability","aliases":["CVE-2026-123783"],"related":[],"title":"Skyvern: sandbox bypass lets logged-in users run code on server","description":"Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is_safe_script_code AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.","summary":"Skyvern, an AI browser automation tool, has a sandbox escape in its script runner: authenticated users can rebuild functions from raw bytecode to evade the AST denylist. A successful attacker runs arbitrary code inside the Skyvern server process, including importing blocked modules like subprocess and socket.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-browser-automation","ai-tooling","python","self-hosted","skyvern"],"not_affected_if":["auth-required","managed-hosting","no-user-scripts"],"how_to_check":"- Check the installed Skyvern version against the ranges in the NVD entry (affected through `1.0.56`)\n- Confirm whether users can deploy or run custom scripts on your Skyvern instance","fix":"- Move to a Skyvern release newer than `1.0.56` (the fixed version is not stated in the sources; see the linked patch)","status":"open","published_at":"2026-11-06T15:17:21+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","triaged_at":"2026-11-06T15:43:58+00:00","updated_at":"2026-11-06T15:43:58+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-06T15:43:58Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Skyvern release newer than `1.0.56` (the fixed version is not stated in the sources; see the linked patch)","reach":"network","title":"Skyvern: sandbox bypass lets logged-in users run code on server","impact":"high","summary":"Skyvern, an AI browser automation tool, has a sandbox escape in its script runner: authenticated users can rebuild functions from raw bytecode to evade the AST denylist. A successful attacker runs arbitrary code inside the Skyvern server process, including importing blocked modules like subprocess and socket.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["skyvern","self-hosted","python","ai-browser-automation"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"code runs in the Skyvern server process; secrets and data readable","analyst_note":"Confirm the fixed version and whether the script feature is on by default, using the linked patch on github.com and the vulncheck advisory.","how_to_check":"- Check the installed Skyvern version against the ranges in the NVD entry (affected through `1.0.56`)\n- Confirm whether users can deploy or run custom scripts on your Skyvern instance","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","no-user-scripts","auth-required"],"who_is_affected":"Teams that self-host Skyvern and let users, including low-privilege accounts, deploy or run scripts. The flaw needs an authenticated account and the script execution feature. Instances where only trusted operators can log in and no script deployment is exposed carry lower risk, but the patch still applies.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4283,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123783':15A,18A '-2026':14A,17A '1.0.56':79C 'ai':20B,24B,33B 'ai-browser-autom':19B 'ai-tool':23B 'allow':86C 'arbitrari':62B 'ast':56B,111C 'attack':60B,100C 'authent':45B,87C 'autom':22B,35B 'block':71B,115C 'browser':21B,34B 'bypass':3A,83C 'bytecod':52B,97C 'code':10A,63B,91C,110C,124C 'contain':80C 'cve':13A,16A 'denylist':57B,112C 'deploy':102C 'escap':40B 'evad':54B,105C 'execut':90C 'function':49B,94C 'host':29B 'import':70B,114C 'includ':69B 'insid':64B 'let':4A 'like':73B 'log':6A 'logged-in':5A 'modul':72B,116C 'process':68B,129C 'python':26B 'raw':51B,96C 'rebuild':48B 'reconstruct':93C 'run':9A,61B,123C 'runner':44B 'safe':108C 'sandbox':2A,39B,82C 'script':43B,103C,109C 'self':28B 'self-host':27B 'server':12A,67B,128C 'skyvern':1A,30B,31B,66B,77C,127C 'socket':76B,121C 'subprocess':74B,119C 'success':59B 'tool':25B,36B 'types.codetype':99C 'user':8A,46B,88C 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Skyvern and let users, including low-privilege accounts, deploy or run scripts. The flaw needs an authenticated account and the script execution feature. Instances where only trusted operators can log in and no script deployment is exposed carry lower risk, but the patch still applies.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aibrowserautomation","aitooling","high","python","selfhosted","skyvern"],"campaign_type":null,"search_a":"'-123783':15A,18A '-2026':14A,17A 'bypass':3A 'code':10A 'cve':13A,16A 'let':4A 'log':6A 'logged-in':5A 'run':9A 'sandbox':2A 'server':12A 'skyvern':1A 'user':8A","search_b":"'ai':20B,24B,33B 'ai-browser-autom':19B 'ai-tool':23B 'arbitrari':62B 'ast':56B 'attack':60B 'authent':45B 'autom':22B,35B 'block':71B 'browser':21B,34B 'bytecod':52B 'code':63B 'denylist':57B 'escap':40B 'evad':54B 'function':49B 'host':29B 'import':70B 'includ':69B 'insid':64B 'like':73B 'modul':72B 'process':68B 'python':26B 'raw':51B 'rebuild':48B 'run':61B 'runner':44B 'sandbox':39B 'script':43B 'self':28B 'self-host':27B 'server':67B 'skyvern':30B,31B,66B 'socket':76B 'subprocess':74B 'success':59B 'tool':25B,36B 'user':46B","search_c":"'1.0.56':79C 'allow':86C 'ast':111C 'attack':100C 'authent':87C 'block':115C 'bypass':83C 'bytecod':97C 'code':91C,110C,124C 'contain':80C 'denylist':112C 'deploy':102C 'evad':105C 'execut':90C 'function':94C 'import':114C 'modul':116C 'process':129C 'raw':96C 'reconstruct':93C 'run':123C 'safe':108C 'sandbox':82C 'script':103C,109C 'server':128C 'skyvern':77C,127C 'socket':121C 'subprocess':119C 'types.codetype':99C 'user':88C 'vulner':84C","first_public_at":"2026-11-06T15:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123783","severity":null,"published_at":"2026-11-06T15:17:21+00:00","modified_at":"2026-11-06T15:17:21+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","fetched_at":"2026-11-06T15:42:44+00:00","note":null}],"documents":[{"id":87591,"url":"https://github.com/Skyvern-AI/skyvern/commit/31a64c1a4b5dfaf1e76a7164845e10f2d68248dc","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87592,"url":"https://www.vulncheck.com/advisories/skyvern-through-1.0.56-script-sandbox-bypass-via-types-codetype-bytecode","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}