This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Jinja Runtime Leak in `sdk/workflow/models/block.py`. <br>๐ฅ **Consequences**: Remote Code Execution (RCE). Attackers can execute arbitrary commands on the server.
Q2Root Cause? (CWE/Flaw)
๐ก๏ธ **Root Cause**: CWE-1336 (Improper Control of Generation of Code). <br>๐ **Flaw**: Unsafe Jinja2 template rendering allows code injection via workflow blocks.
๐ **Attacker Capabilities**: Full RCE. <br>๐ **Privileges**: Can execute system commands (e.g., reverse shells). <br>๐ **Data**: Potential access to server files and environment variables.
Q5Is exploitation threshold high? (Auth/Config)
๐ **Threshold**: Medium. <br>๐ **Auth Required**: Yes (Low Privilege). <br>โ๏ธ **Config**: Requires a valid `X-API-KEY` to trigger the exploit.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฃ **Public Exploit**: YES. <br>๐ **PoC**: Available on GitHub (`cristibtz/CVE-2025-49619`) and Exploit-DB (52335). <br>๐ง **Type**: Reverse Shell script.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for Skyvern instances on port 8000/8080. <br>๐ **Verify**: Check version number against 0.1.85. <br>๐ก๏ธ **Monitor**: Look for suspicious outbound network connections (reverse shells).
Q8Is it fixed officially? (Patch/Mitigation)
๐ฉน **Fix**: Official patch committed in GitHub commit `db856cd`. <br>โ **Status**: Fixed in versions > 0.1.85. <br>๐ฅ **Action**: Upgrade Skyvern immediately.
Q9What if no patch? (Workaround)
๐ง **No Patch?**: Isolate the Skyvern server. <br>๐ซ **Block**: Restrict API key usage. <br>๐ **Mitigate**: Disable Jinja2 template rendering if possible. <br>๐ **Watch**: Monitor logs for `block.py` anomalies.