incidents: add INC-148, Devika Runner.execute runs LLM-generated commands (CVE-2026-51871)

[emmanuelgjr]

Adds incident INC-148 for CVE-2026-51871 in Devika, an open-source AI software-engineering agent. Triaged in #212 under the CVEs section of docs/TRIAGE_RULES.md, and modelled on INC-132 (Agno).

Closes #212

The record

field	value
title	Devika agent: LLM-generated commands executed without validation in Runner.execute
incident_class / category	tooling-cve / research-demonstrated
severity	Critical, transcribed from CVSS 3.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, a secondary metric from the CISA ADP
affected	Devika v1.0, as named by the CVE. The repo publishes no releases or tags.
fix	none
references	NVD; the researcher's write-up (gist); stitionai/devika#714
mapping_status	draft

Mechanism. I checked this in src/agents/runner/runner.py at the head of the repo (80bb343):

• Runner.execute sends the prompt to the model and takes response["commands"].
• run_code runs each command with subprocess.run in the project directory.
• The only check is that a commands field exists.

Provenance is thin, and the description says so, as INC-132's does:

• the CNA is MITRE, not the vendor;
• NVD lists the record as Deferred, with no score of its own;
• SSVC exploitation is poc;
• there is no vendor advisory;
• the upstream issue has been open since 2026-05-23;
• the repo's last push was 2025-09-25.

C4: DRAFT, SME review required

• owasp_entries: ASI05, LLM10, LLM01. The schema requires at least one entry, so these are drafted rather than left empty. mapping_status: draft records that no SME has signed them off.
  • The watcher suggested LLM08 / ASI01. I didn't adopt those, because the mechanism is model output reaching an execution sink, not a hijacked goal.
  • A reviewer should confirm or replace all three.
• control_failures: OWASP ASVS 5.0.0 V1.3.2 (avoid dynamic code execution; sanitise any input before executing it), outcome absent.
  • basis quotes the write-up verbatim: "Accepts LLM-generated commands without sanitization".
  • confirmed_by is [].
  • It matches the CVE's CWE-94, ASI05 and LLM10 already map V1.3.2, and INC-140 used the same control.
  • A first draft against MITRE ATLAS AML.T0050 raised the validator's "failed, but no entry maps it" warning. That's another reason for V1.3.2.
• maestro_layers: L3 is the origin (the runner) and L4 the impact (the host). Both are drafted on the INC-132 pattern.

Regenerated

generate.js, npm run stats and render-stats.mjs were run.

What changed	From → to
Incident count (README, stats, banner, og-image)	147 → 148
Annotated incidents	24 → 25
Control failures	34 → 35
Backlinks added	ASI05, LLM01, LLM10
evidence.drafted added	V1.3.2 mappings in ASI05 and LLM10

docs/*.js changes are data-fed bundles only. No structural webapp change (C2).

Checks (local)

• validate.js: 0 errors / 92 warnings / 329 passed, the same counts as main.
• test:scripts: 137/137.
• stats:check: current.
• A second generate.js + stats run is byte-identical.
• next-incident-id --check-prs: INC-148 isn't claimed by any open PR.

This PR and #222 touch disjoint files.

🤖 Generated with Claude Code