GHSA-h92g-3xc3-ww2r

Suggest an improvement
Source
https://github.com/advisories/GHSA-h92g-3xc3-ww2r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-h92g-3xc3-ww2r/GHSA-h92g-3xc3-ww2r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h92g-3xc3-ww2r
Aliases
Published
2025-06-07T15:30:18Z
Modified
2025-06-17T22:17:26.542918Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Skyvern has a Jinja runtime leak
Details

Skyvern through 0.2.0 has a Jinja runtime leak in sdk/workflow/models/block.py.

Database specific 
{
    "nvd_published_at": "2025-06-07T14:15:21Z",
    "cwe_ids": [
        "CWE-1336"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-09T13:04:44Z"
}
References

Affected packages

PyPI / skyvern

Package

Name
skyvern
View open source insights on deps.dev
Purl
pkg:pypi/skyvern

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.2.0

Affected versions

0.*
0.1.53
0.1.55
0.1.56
0.1.62
0.1.63
0.1.64
0.1.66
0.1.67
0.1.68
0.1.69
0.1.70
0.1.71
0.1.72
0.1.73
0.1.74
0.1.75
0.1.76
0.1.77
0.1.78
0.1.79
0.1.81
0.1.82
0.1.83
0.1.84
0.1.85
0.1.86
0.1.88
0.1.89
0.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-h92g-3xc3-ww2r/GHSA-h92g-3xc3-ww2r.json"