Skyvern has a Jinja runtime leak

HIGH 8.5CVE-2025-49619 · GHSA-h92g-3xc3-ww2r · PYSEC-2026-1929 · Published 07/06/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
skyvern PyPI	`≤ 0.2.0`	No fix yet

Description

Skyvern through 0.2.0 has a Jinja runtime leak in sdk/workflow/models/block.py.

NVD description

Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to blind remote code execution (RCE).

References

nvd.nist.gov/vuln/detail/CVE-2025-49619 · ADVISORY
Skyvern-AI/skyvern commit db856cd · WEB
cristibtz.blog/posts/CVE-2025-49619 · WEB
cristibtz.github.io/posts/CVE-2025-49619 · WEB
Skyvern-AI/skyvern · PACKAGE
exploit-db.com/exploits/52335 · WEB
cristibtz.github.io/posts/CVE-2025-49619
cristibtz.blog/posts/CVE-2025-49619
pypi.org/project/skyvern · PACKAGE
GitHub Advisory GHSA-h92g-3xc3-ww2r · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free