CVE-2026-123783

47th percentile - higher than 47% of all known CVEs

Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is_safe_script_code AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.

An authenticated user can execute arbitrary code in the server process, potentially leading to server compromise and access to other users' data. The sandbox bypass undermines the platform's core security assumption.

Update Skyvern to a version later than 1.0.56 when available. Also limit the number of authenticated users allowed to deploy scripts and monitor for unusual activity in the server process.