CVE-2025-49619
Skyvern has a Jinja runtime leak
CVE-2025-49619 is a high vulnerability (CVSS 8.5) in Skyvern, published June 7, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 21.8%, the 97th percentile. No source names a fixed version.
- Severity
- 8.5 HighCVSS 3.1, CVE List
- Exploit chance
- 21.8%EPSS, 97th percentile
- Exploitation
- None known3 public exploits
- Fixed in
- No fix listedNo source names one
Description
Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to blind remote code execution (RCE).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
skyvernPyPI | through 0.2.0 | None known |
skyvernPyPI | through 0.2.0, plus listed versions 0.1.530.1.550.1.560.1.620.1.63 Show 23 moreShow less0.1.640.1.660.1.670.1.680.1.690.1.700.1.710.1.720.1.730.1.740.1.750.1.760.1.770.1.780.1.790.1.810.1.820.1.830.1.840.1.850.1.860.1.880.1.89 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Skyvern 0.1.85 - Remote Code Execution (RCE) via SSTI | 2025-06-15 |
| Metasploit | Skyvern SSTI Remote Code Execution | 2025-06-07 |
| PoC in GitHub | cristibtz/CVE-2025-49619 | 2025-06-09 |
What each source reports
CVE List Score used
Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to blind remote code execution (RCE).
- Record
CVE-2025-49619- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-1336
- Updated
- 2026-11-02
EUVDEUVD-2025-17375
Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to blind remote code execution (RCE).
- Record
EUVD-2025-17375- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h92g-3xc3-ww2r
Skyvern has a Jinja runtime leak
Skyvern through 0.2.0 has a Jinja runtime leak in sdk/workflow/models/block.py.
- Record
GHSA-h92g-3xc3-ww2r- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-1336
- Updated
- 2026-11-02
NVD
Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to blind remote code execution (RCE).
- Record
CVE-2025-49619- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSV
Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to blind remote code execution (RCE).
- Record
CVE-2025-49619- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSVGHSA-h92g-3xc3-ww2r
Skyvern has a Jinja runtime leak
Skyvern through 0.2.0 has a Jinja runtime leak in sdk/workflow/models/block.py.
- Record
GHSA-h92g-3xc3-ww2r- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSVPYSEC-2026-1929
Skyvern has a Jinja runtime leak
Skyvern through 0.2.0 has a Jinja runtime leak in sdk/workflow/models/block.py.
- Record
PYSEC-2026-1929- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/Skyvern-AI/skyvern/commit/db856cd8433a204c8b45979c70a4da1e119d949d
cristibtz.github.io/posts/CVE-2025-49619
exploit-db.com/exploits/52335
cristibtz.blog/posts/CVE-2025-49619
nvd.nist.gov/vuln/detail/CVE-2025-49619
pypi.org/project/skyvern