CVE-2025-49619 in the critical feed json
Skyvern has a Jinja runtime leak
published last yr. modified 4mo ago also GHSA-h92g-3xc3-ww2r , PYSEC-2026-1929 , EUVD-2025-17375
- cvss
- 8.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 21.8%
- EPSS 21.8% chance of exploitation in 30 days, percentile 97%
- public exploits
- 2
- Metasploit and Exploit-DB
Summary
Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to blind remote code execution (RCE).
Patch / fix
Is CVE-2025-49619 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- Published
- First public exploit (Metasploit exploit/linux/http/skyvern_ssti_cve_2025_49619)
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
21.81% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/linux/http/skyvern_ssti_cve_2025_49619 Skyvern SSTI Remote Code Execution metasploit exploit, excellent rank, 2025-06-07
- EDB-52335 Skyvern 0.1.85 - Remote Code Execution (RCE) via SSTI webapps, 2025-06-15
- cristibtz.blog https://cristibtz.blog/posts/CVE-2025-49619/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
| OSV | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
| GitHub | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | skyvern | <=0.2.0 |
no fix listed |
Affected products
- Skyvern Skyvern
Classification
- Weakness
-
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
References
-
github.com
/Skyvern-AI/skyvern/commit/db856cd8433a204c8b45979c70a4da1e119d949d
web
-
cristibtz.blog
/posts/CVE-2025-49619/
exploit
- cristibtz.github.io /posts/CVE-2025-49619/
-
exploit-db.com
/exploits/52335
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-49619
advisory
-
cristibtz.blog
/posts/CVE-2025-49619
web
-
cristibtz.github.io
/posts/CVE-2025-49619
web
-
github.com
/Skyvern-AI/skyvern
package
-
pypi.org
/project/skyvern
package
-
github.com
/advisories/GHSA-h92g-3xc3-ww2r
advisory
Sources
- CVE List CVE-2025-49619
- GitHub Advisory GHSA-h92g-3xc3-ww2r
- NVD CVE-2025-49619
- OSV PYSEC-2026-1929
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.