Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

skyvern-ai/skyvern

              main @ 746644c
            

Fixes

CVEs

HIGH

Peak severity

32.4%

Coverage

Highlights

Auth Bypass: 23 prior fixes. Scrutinize any change in this area.

skyvern/forge/sdk/workflow/models/block.py: most-fixed (22 issues). Treat as high-risk during review.

43 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Server-Side Template Injection: Insecure rendering of user-controlled Jinja2 templates directly in workflow blocks allowed arbitrary template evaluation and potential code execution. This was addressed by migrating standard Jinja2 template rendering to a SandboxedEnvironment.

Sandbox Escape: Python CodeBlock execution is highly sensitive. Attackers could manipulate AST attributes or use private underscore attributes to bypass limits and escape the execution sandbox. Fixes enforced AST validation, private attribute blocking, and disabled direct execution paths.

Auth Bypass: Database query logic frequently omitted multi-tenant organization_id filters, allowing users to fetch or manipulate persistent browser sessions, workflow runs, and script blocks belonging to other organizations.