Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.

Skyvern versions before 1.0.45 contain a critical sandbox escape vulnerability in the TextPromptBlock component. The flaw arises because prompts are rendered twice: first through a sandboxed Jinja environment and then through an unsandboxed one. This double-rendering allows attackers to inject malicious Jinja template syntax via workflow parameters or upstream block output. Successful exploitation enables arbitrary code execution with server process privileges. The vulnerability is tracked as CVE-2026-82447 and was patched in version 1.0.45. A fix was committed in commit d723de621d5b3a340f3cc4d5b46bfe40a9a3124e. Affected files include skyvern/forge/sdk/prompting.py and skyvern/forge/sdk/workflow/models/block.py.