CVE-2026-123783

Skyvern workflow scripts can escape the script sandbox

Skyvern · Skyvern script sandbox

First documented disclosure · Review checkpoint

Summary

Authenticated workflow scripts can exceed sandbox restrictions.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Source-code checks did not constrain all behavior available to scripts at runtime.

Conditions required

An authenticated user must be able to deploy or run a workflow script.

Potential impact

Code can run with the Skyvern server process’s permissions.

Affected versions and configurations

Through 1.0.56.

Fix and mitigation status

1.0.57 contains the fix from October 16.

Practical next steps

Use v1.0.57 or a build containing the October 16 sandbox fix. Restrict script authoring.

Operating lesson

Treat script execution as a separate privilege and isolate its runtime.

Evidence and limits

The October 16 public report and maintainer patch predate CVE assignment. The November 6 v1.0.57 release contains the cited fix.

Sources