CVE Feed

    Dashboard / CVE / CVE-2026-51871

    CVE-2026-51871

    Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content.

    Published:Sep 30, 2026
    Last Modified:Oct 1, 2026
    EPS:Sep 30, 2026
    EPSS Score:0.00233
    CVSS Score:9.8

    Affected Products

    Vendor
    Stitionai
    Product
    Devika

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-51873 (CVSS 8.8) — Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows atta…
    CVE-2026-51874 (CVSS 7.5) — In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that a…
    CVE-2026-51875 (CVSS 9.1) — In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that a…
    CVE-2026-51872 (CVSS 9.8) — Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.…
    CVE-2024-5752 (CVSS 9.1) — A path traversal vulnerability exists in stitionai/devika, specifically in the project creation functionality.…
    CVE-2024-7790 (CVSS 6.5) — A stored cross site scripting vulnerabilities exists in DevikaAI from commit 6acce21fb08c3d1123ef05df6a33912bf…
    CVE-2024-6331 (CVSS 7.5) — stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File…
    CVE-2024-40422 (CVSS 9.1) — The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to…
    CVE-2024-6433 (CVSS 7.5) — The application zips all the files in the folder specified by the user, which allows an attacker to read arbit…
    CVE-2024-5549 (CVSS 8.1) — A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information suc…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High