[new-cve] CVE-2026-51871 — Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in sr #212

Activity

1. github-actions

   added

   automated-watch

   new-cve

   on Oct 5, 2026
2. emmanuelgjr commented on Oct 9, 2026

   

   emmanuelgjr

   on Oct 9, 2026

   Contributor

   More actions

   Triage: incident record, following the INC-132 precedent.

   CVE-2026-51871: "Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content."

   Checked against docs/TRIAGE_RULES.md (CVEs):

   • GenAI tooling, with an affected version: Devika v1.0, an open-source AI software-engineering agent. Unlike the SQLBot XSS closed in [new-cve] CVE-2026-53555 — SQLBot is an intelligent Text-to-SQL system based on large language models and R #149, the mechanism is specific to GenAI: the code that is executed comes from the LLM.
   • Provenance is thin, and the record will say so, as INC-132 (Agno, CVE-2026-37003) does:
     • the CNA is MITRE (cve@mitre.org), not the vendor;
     • NVD lists the record as Deferred, with no score of its own;
     • the CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is a secondary metric from the CISA ADP, which also records SSVC exploitation as poc;
     • there is no vendor advisory: stitionai/devika has no repository security advisories and no releases, and its last push was 2025-09-25;
     • the citable sources are the researcher's write-up (gist) and the still-open upstream issue stitionai/devika#714.
   • Not yet recorded: data/incidents.json has no Devika record.

   A PR will add INC-148:

   • incident_class: tooling-cve, category: research-demonstrated;
   • severity Critical, transcribed from the secondary CVSS with its source stated;
   • affected "Devika v1.0", with no fix available;
   • references to NVD, the gist and issue #714;
   • mapping_status: draft, with OWASP entries left for SME review;
   • control_failures quoting the CVE text, with confirmed_by empty.

   The watcher suggested LLM08 / ASI01. That suggestion is not adopted here, because which entries apply is a C4 call.
3. emmanuelgjr commented on Oct 9, 2026

   

   emmanuelgjr

   on Oct 9, 2026

   Contributor

   More actions

   INC-148 is in #223. The control failure is drafted against OWASP ASVS 5.0.0 V1.3.2, and OWASP entries ASI05, LLM10 and LLM01 are drafted for SME review; the PR explains why.