CVE Feed

    Dashboard / CVE / CVE-2026-51874

    CVE-2026-51874

    In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace.

    Published:Oct 1, 2026
    Last Modified:Oct 5, 2026
    EPS:Oct 1, 2026
    EPSS Score:0.00155
    CVSS Score:7.5

    Affected Products

    Vendor
    Stitionai
    Product
    Devika

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-51873 (CVSS 8.8) — Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows atta…
    CVE-2026-51875 (CVSS 9.1) — In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that a…
    CVE-2026-51871 (CVSS 9.8) — Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py whic…
    CVE-2026-51872 (CVSS 9.8) — Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.…
    CVE-2024-5752 (CVSS 9.1) — A path traversal vulnerability exists in stitionai/devika, specifically in the project creation functionality.…
    CVE-2024-7790 (CVSS 6.5) — A stored cross site scripting vulnerabilities exists in DevikaAI from commit 6acce21fb08c3d1123ef05df6a33912bf…
    CVE-2024-6331 (CVSS 7.5) — stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File…
    CVE-2024-40422 (CVSS 9.1) — The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to…
    CVE-2024-6433 (CVSS 7.5) — The application zips all the files in the folder specified by the user, which allows an attacker to read arbit…
    CVE-2024-5549 (CVSS 8.1) — A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information suc…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High