CVE-2026-51875
UnknownSummary
In Devika v1.0, the Feature Agent's save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server.
Risk Assessment
An attacker can write files anywhere on the server's filesystem, potentially leading to full server compromise or modification of critical files.
Recommendation
Immediately update Devika to the latest version if available, and implement path validation in the save_code_to_project function to prevent writes outside the allowed directory.
Other vulnerabilities in Devika
See all- CVE-2026-51874Unknown
In Devika v1.0, the Patcher Agent's save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace.
- CVE-2026-51873Unknown
Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.
- CVE-2026-51871Critical
Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content.
- CVE-2026-51872Low risk· EPSS 10%
Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.
Original NVD description (English source)
In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS