Skyvern accepted workflow Python after inspecting its abstract syntax tree, then loaded the accepted script through the real interpreter. The public issue describes literal bytes becoming executable CodeType and FunctionType objects after that inspection. The reconstructed instructions were outside the syntax the filter had examined. The script feature…
Case · DiggingBeagle record
Skyvern's AST gate missed executable bytecode constructed after validation
The workflow-script bypass reconstructed Python code objects from literal bytes. Source checks were repaired, but the advisory did not identify the first fixed package release; this was not an escape from a container or hypervisor.
Public disclosure: Oct 16, 2026
Scope
Vulnerability reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
The cited first-party advisory or research establishes the stated mechanism only within its documented conditions. No unrelated production compromise, extended victim scope, financial harm or universal mitigation is inferred.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-SKYVERN-BYTECODE-MECHANISM · CLM-SKYVERN-BYTECODE-FIX-LIMIT · Skyvern Python workflow script static-check bypass report · Skyvern GHSA-2555-vffj-g73c advisory
At a glance
Source-level allowlist and denylist checks are not runtime containment. The exact bug is in workflow-script policy enforcement, not an escape from a container or hypervisor.
Read the implicationsNo public production victim or real credential theft; the executable script feature was not designed as a complete isolation sandbox and the patched package version is unspecified.
Limits and uncertaintyFull account
Skyvern accepted workflow Python after inspecting its abstract syntax tree, then loaded the accepted script through the real interpreter. The public issue describes literal bytes becoming executable CodeType and FunctionType objects after that inspection. The reconstructed instructions were outside the syntax the filter had examined.
The script feature used genuine Python builtins without a separate runtime sandbox. The result therefore bypassed a source-level safety gate; describing it as a container or hypervisor escape would misstate the boundary. Permission to submit and execute workflow scripts remains a prerequisite.
Source repair is not a package-release boundary
The issue opened October 16, following a reported September 9 private submission. An October 20 maintainer comment describes blocking the relevant constructors and adding regression tests; the issue closed November 5. The November 6 CVE advisory describes Skyvern through 1.0.56 but leaves the patched package version unknown. November 6 is not the first public disclosure of the underlying issue.
The published reproduction and tests support the reported bypass; they were not independently executed for this dossier. No production victim or credential theft is established. Blocking this gadget also does not prove that a syntax denylist provides complete containment against other code-construction paths.
Mechanism and trust boundary
- 01
Submit workflow Python in a configuration where script execution is authorized and the static AST denylist is the security check.
- 02
Use literal byte sequences to create Python code objects through types.CodeType and types.FunctionType only after the syntactic inspection.
- 03
Execute the reconstructed function using the regular Python interpreter, outside the scope of that syntactic inspection.
Claims & evidence
CLM-SKYVERN-BYTECODE-FIX-LIMITThe advisory describes affected Skyvern versions through 1.0.56; source-level checks were changed, but it does not identify a confirmed fixed package release.supported
Basis: reported finding
- supportsSkyvern GHSA-2555-vffj-g73c advisoryvendor statement
GHSA-2555-vffj-g73c, Affected versions and Patched versions
CLM-SKYVERN-BYTECODE-MECHANISMThe researcher demonstrated that bytes can be reconstructed into executable Python code after the AST filter admits an apparently safe workflow script.supported
Basis: reported finding
- supportsSkyvern Python workflow script static-check bypass reportprimary disclosure
Issue #8927, Description and proof-of-concept; is_safe_script_code and importlib execution
CLM-ENR231-SKYVERN-NO-RUNTIME-SANDBOXThe Skyvern issue states that uploaded scripts ran as imported Python modules with real builtins and no runtime sandbox, leaving an AST denylist as the sole gate before the bytecode-construction bypass.supported
Basis: reported finding
- supportsSkyvern Python workflow script static-check bypass reportprimary disclosure
Issue #8927, Summary and Details: is_safe_script_code and importlib module execution
Implications
Source-level allowlist and denylist checks are not runtime containment. The exact bug is in workflow-script policy enforcement, not an escape from a container or hypervisor.
Controls and mitigations
- Restrict who can upload executable workflow scripts, apply runtime isolation, and test all code-construction mechanisms in the fixed distribution.
Unknowns and contradictions
- No public production victim or real credential theft; the executable script feature was not designed as a complete isolation sandbox and the patched package version is unspecified.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233