diff --git a/README.md b/README.md
index 12b637f..be6fd2a 100644
--- a/README.md
+++ b/README.md
@@ -90,7 +90,7 @@ node scripts/incidents-report.js --format stix # SIEM/SOAR export
| **Red teamer** | [LAAF guide](evals/laaf/README.md) → run S1–S6 attack stages, map results to OWASP |
| **GRC / auditor** | `compliance-report.js --format oscal` → import into ServiceNow/Archer |
| **Developer** | `npm install genai-security-crosswalk` → query risks + controls programmatically |
-| **Threat intel analyst** | `incidents-report.js --format stix` → ingest 147 AI incidents into Sentinel/Splunk |
+| **Threat intel analyst** | `incidents-report.js --format stix` → ingest 148 AI incidents into Sentinel/Splunk |
---
@@ -178,7 +178,7 @@ Every file answers one question: **which controls from framework X address vulne
| **70+** open-source tools | Catalogued and organised by function |
| **25** eval profiles | Runnable Garak (13) + PyRIT (6) + LAAF (6) tests mapped to OWASP entries |
| **26** compliance reports | Per-framework gap assessments auto-generated from data layer (MD, CSV, JSON, OSCAL) |
-| **147** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) |
+| **148** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) |
| **LAAF v2.0** | First agentic LPCI red-teaming framework — fully integrated with 6-stage × OWASP crosswalk |
All free. All open-source. Built for practitioners.
@@ -432,7 +432,7 @@ crosswalk/
│
├── data/
│ ├── schema.json ← JSON Schema (Draft 7) for entry files
-│ ├── incidents.json ← 147 incidents with MAESTRO layer attribution
+│ ├── incidents.json ← 148 incidents with MAESTRO layer attribution
│ ├── incidents-schema.json ← JSON Schema for incidents
│ ├── tools-supplement.json ← Supplemental tools merged at generation time
│ ├── entries/ ← 51 machine-readable entry JSON files
@@ -517,7 +517,7 @@ See `evals/laaf/README.md` for the full LPCI attack vector → OWASP → MAESTRO
## Incident tracker
-The tracker holds 147 real-world and research-demonstrated incidents, each
+The tracker holds 148 real-world and research-demonstrated incidents, each
mapped to OWASP entries and MAESTRO architectural layers:
```bash
@@ -543,7 +543,7 @@ No install required. Works on desktop and mobile.
| [**Score**](https://genai-security-project.github.io/crosswalk/#/score) | Select your frameworks, see coverage gaps. Upload Garak/PyRIT/LAAF results to validate. Share your score card on LinkedIn. |
| [**Explorer**](https://genai-security-project.github.io/crosswalk/#/explorer) | Search and filter all 51 entries. Click any entry to see controls across all 26 frameworks. |
| [**Frameworks**](https://genai-security-project.github.io/crosswalk/#/frameworks) | Interactive 51×26 coverage matrix. Click any cell to see the specific controls mapped. |
-| [**Incidents**](https://genai-security-project.github.io/crosswalk/#/incidents) | Browse 147 AI security incidents. Filter by severity, year, MAESTRO layer. Full attribution details. |
+| [**Incidents**](https://genai-security-project.github.io/crosswalk/#/incidents) | Browse 148 AI security incidents. Filter by severity, year, MAESTRO layer. Full attribution details. |
**Evidence-based scoring** — three validation tiers:
diff --git a/data/entries/ASI05.json b/data/entries/ASI05.json
index 0dfccf9..bef6d96 100644
--- a/data/entries/ASI05.json
+++ b/data/entries/ASI05.json
@@ -329,7 +329,14 @@
"notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review",
"framework_version": "ASVS 5.0.0",
"confidence": "unreviewed",
- "reviewed_by": []
+ "reviewed_by": [],
+ "evidence_count": 0,
+ "evidence": {
+ "confirmed": [],
+ "drafted": [
+ "INC-148"
+ ]
+ }
},
{
"framework": "OWASP ASVS 5.0.0",
@@ -1173,6 +1180,12 @@
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-132"
+ },
+ {
+ "name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
+ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+ "year": 2026,
+ "incident_id": "INC-148"
}
],
"crossrefs": {
diff --git a/data/entries/LLM01.json b/data/entries/LLM01.json
index b0aec48..e11a405 100644
--- a/data/entries/LLM01.json
+++ b/data/entries/LLM01.json
@@ -1444,6 +1444,12 @@
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-147"
+ },
+ {
+ "name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
+ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+ "year": 2026,
+ "incident_id": "INC-148"
}
],
"crossrefs": {
diff --git a/data/entries/LLM10.json b/data/entries/LLM10.json
index b35f9af..590a09d 100644
--- a/data/entries/LLM10.json
+++ b/data/entries/LLM10.json
@@ -267,7 +267,14 @@
"notes": "No eval or dynamic code execution of LLM-generated content",
"framework_version": "ASVS 5.0.0",
"confidence": "unreviewed",
- "reviewed_by": []
+ "reviewed_by": [],
+ "evidence_count": 0,
+ "evidence": {
+ "confirmed": [],
+ "drafted": [
+ "INC-148"
+ ]
+ }
},
{
"framework": "OWASP ASVS 5.0.0",
@@ -1074,6 +1081,12 @@
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2024,
"incident_id": "INC-075"
+ },
+ {
+ "name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
+ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+ "year": 2026,
+ "incident_id": "INC-148"
}
],
"crossrefs": {
diff --git a/data/incidents.json b/data/incidents.json
index f09429e..420068a 100644
--- a/data/incidents.json
+++ b/data/incidents.json
@@ -9529,6 +9529,88 @@
"confirmed_by": []
}
]
+ },
+ {
+ "id": "INC-148",
+ "title": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
+ "date": "2026-09",
+ "year": 2026,
+ "category": "research-demonstrated",
+ "incident_class": "tooling-cve",
+ "severity": "Critical",
+ "description": "CVE-2026-51871, published 2026-09-30, states that \"Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content.\" Devika is an open-source AI software-engineering agent. At the repository's head, Runner.execute takes the commands from the model's response and run_code runs each one with subprocess.run in the project directory; the only check is that the response contains a commands field. The researcher's write-up gives the attack surface as the Socket.IO service entry and the root cause as \"Accepts LLM-generated commands without sanitization\". Provenance is thin, as for INC-132: the CNA is MITRE rather than the vendor; NVD lists the record as Deferred with no score of its own; the CVSS 3.1 score of 9.8 (Critical) is a secondary metric from the CISA ADP, which records SSVC exploitation as \"poc\"; and there is no vendor advisory or fix. The upstream issue (stitionai/devika#714, opened 2026-05-23) is still open, the repository publishes no releases or tags, and its last push was 2025-09-25. The record is included because the CVE is published and its mechanism is stated and visible in the source; the evidence behind the score is not the vendor's.",
+ "owasp_entries": [
+ "ASI05",
+ "LLM10",
+ "LLM01"
+ ],
+ "mapping_status": "draft",
+ "maestro_layers": [
+ {
+ "layer": "L3",
+ "label": "Agent Frameworks",
+ "role": "origin",
+ "notes": "The agent runner passes commands from the model response straight to subprocess.run"
+ },
+ {
+ "layer": "L4",
+ "label": "Deployment & Infrastructure",
+ "role": "impact",
+ "notes": "Commands run on the host with the service's permissions"
+ }
+ ],
+ "attack_vector": "Messages to the agent through its Socket.IO service entry shape the model's response, whose commands field Runner.execute runs with subprocess.run",
+ "affected": "Devika v1.0, as named by the CVE; the repository publishes no releases or tags",
+ "impact": "Arbitrary command execution on the host running Devika, with the service's permissions",
+ "mitigations": [
+ "No fix is available; do not expose the Devika service to untrusted users or networks",
+ "Treat model-generated commands as untrusted input: allow-list them, or require human approval before execution",
+ "Run the agent in a sandbox with no host filesystem, credential or network reach"
+ ],
+ "external_refs": [
+ {
+ "source": "CVE",
+ "id": "CVE-2026-51871",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51871"
+ }
+ ],
+ "references": [
+ {
+ "title": "NVD — CVE-2026-51871",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51871",
+ "type": "advisory"
+ },
+ {
+ "title": "Researcher write-up of CVE-2026-51871 (Ro1ME)",
+ "url": "https://gist.github.com/Ro1ME/3067a5bd69dcd35ffc98dc41ca611242",
+ "type": "research"
+ },
+ {
+ "title": "stitionai/devika issue #714: Code Injection in Runner.execute",
+ "url": "https://github.com/stitionai/devika/issues/714",
+ "type": "disclosure"
+ }
+ ],
+ "tags": [
+ "cve",
+ "tooling-cve",
+ "agentic",
+ "code-execution",
+ "devika",
+ "no-fix",
+ "draft-evidence",
+ "draft-mapping"
+ ],
+ "control_failures": [
+ {
+ "framework": "OWASP ASVS 5.0.0",
+ "control_id": "V1.3.2",
+ "outcome": "absent",
+ "basis": "Accepts LLM-generated commands without sanitization",
+ "source_url": "https://gist.github.com/Ro1ME/3067a5bd69dcd35ffc98dc41ca611242",
+ "confirmed_by": []
+ }
+ ]
}
]
}
diff --git a/data/stats.json b/data/stats.json
index 5637bea..0f14963 100644
--- a/data/stats.json
+++ b/data/stats.json
@@ -63,15 +63,15 @@
}
},
"incidents": {
- "total": 147
+ "total": 148
},
"evidence": {
- "incidents_annotated": 24,
- "control_failures": 34,
+ "incidents_annotated": 25,
+ "control_failures": 35,
"confirmed": 0,
- "drafted": 34,
+ "drafted": 35,
"mappings_with_confirmed_evidence": 0,
- "mappings_with_drafted_evidence_only": 29,
+ "mappings_with_drafted_evidence_only": 31,
"orphan_failures": 5
},
"freshness": {
diff --git a/docs/banner.svg b/docs/banner.svg
index 9716b88..1e04c5a 100644
--- a/docs/banner.svg
+++ b/docs/banner.svg
@@ -85,7 +85,7 @@
MAPPINGS
- 147
+ 148
INCIDENTS
diff --git a/docs/data.js b/docs/data.js
index f5cf848..47725a5 100644
--- a/docs/data.js
+++ b/docs/data.js
@@ -1448,6 +1448,12 @@ window.CROSSWALK_DATA = [
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-147"
+ },
+ {
+ "name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
+ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+ "year": 2026,
+ "incident_id": "INC-148"
}
],
"crossrefs": {
@@ -11029,7 +11035,14 @@ window.CROSSWALK_DATA = [
"notes": "No eval or dynamic code execution of LLM-generated content",
"framework_version": "ASVS 5.0.0",
"confidence": "unreviewed",
- "reviewed_by": []
+ "reviewed_by": [],
+ "evidence_count": 0,
+ "evidence": {
+ "confirmed": [],
+ "drafted": [
+ "INC-148"
+ ]
+ }
},
{
"framework": "OWASP ASVS 5.0.0",
@@ -11836,6 +11849,12 @@ window.CROSSWALK_DATA = [
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2024,
"incident_id": "INC-075"
+ },
+ {
+ "name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
+ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+ "year": 2026,
+ "incident_id": "INC-148"
}
],
"crossrefs": {
@@ -18492,7 +18511,14 @@ window.CROSSWALK_DATA = [
"notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review",
"framework_version": "ASVS 5.0.0",
"confidence": "unreviewed",
- "reviewed_by": []
+ "reviewed_by": [],
+ "evidence_count": 0,
+ "evidence": {
+ "confirmed": [],
+ "drafted": [
+ "INC-148"
+ ]
+ }
},
{
"framework": "OWASP ASVS 5.0.0",
@@ -19336,6 +19362,12 @@ window.CROSSWALK_DATA = [
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-132"
+ },
+ {
+ "name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
+ "url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
+ "year": 2026,
+ "incident_id": "INC-148"
}
],
"crossrefs": {
diff --git a/docs/incidents.js b/docs/incidents.js
index ae792c1..a2e905b 100644
--- a/docs/incidents.js
+++ b/docs/incidents.js
@@ -1,5 +1,5 @@
// Auto-generated by scripts/generate.js — do not edit manually
-// Incidents: 147
+// Incidents: 148
window.CROSSWALK_INCIDENTS = [
{
"id": "INC-001",
@@ -9527,5 +9527,87 @@ window.CROSSWALK_INCIDENTS = [
"confirmed_by": []
}
]
+ },
+ {
+ "id": "INC-148",
+ "title": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
+ "date": "2026-09",
+ "year": 2026,
+ "category": "research-demonstrated",
+ "incident_class": "tooling-cve",
+ "severity": "Critical",
+ "description": "CVE-2026-51871, published 2026-09-30, states that \"Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content.\" Devika is an open-source AI software-engineering agent. At the repository's head, Runner.execute takes the commands from the model's response and run_code runs each one with subprocess.run in the project directory; the only check is that the response contains a commands field. The researcher's write-up gives the attack surface as the Socket.IO service entry and the root cause as \"Accepts LLM-generated commands without sanitization\". Provenance is thin, as for INC-132: the CNA is MITRE rather than the vendor; NVD lists the record as Deferred with no score of its own; the CVSS 3.1 score of 9.8 (Critical) is a secondary metric from the CISA ADP, which records SSVC exploitation as \"poc\"; and there is no vendor advisory or fix. The upstream issue (stitionai/devika#714, opened 2026-05-23) is still open, the repository publishes no releases or tags, and its last push was 2025-09-25. The record is included because the CVE is published and its mechanism is stated and visible in the source; the evidence behind the score is not the vendor's.",
+ "owasp_entries": [
+ "ASI05",
+ "LLM10",
+ "LLM01"
+ ],
+ "mapping_status": "draft",
+ "maestro_layers": [
+ {
+ "layer": "L3",
+ "label": "Agent Frameworks",
+ "role": "origin",
+ "notes": "The agent runner passes commands from the model response straight to subprocess.run"
+ },
+ {
+ "layer": "L4",
+ "label": "Deployment & Infrastructure",
+ "role": "impact",
+ "notes": "Commands run on the host with the service's permissions"
+ }
+ ],
+ "attack_vector": "Messages to the agent through its Socket.IO service entry shape the model's response, whose commands field Runner.execute runs with subprocess.run",
+ "affected": "Devika v1.0, as named by the CVE; the repository publishes no releases or tags",
+ "impact": "Arbitrary command execution on the host running Devika, with the service's permissions",
+ "mitigations": [
+ "No fix is available; do not expose the Devika service to untrusted users or networks",
+ "Treat model-generated commands as untrusted input: allow-list them, or require human approval before execution",
+ "Run the agent in a sandbox with no host filesystem, credential or network reach"
+ ],
+ "external_refs": [
+ {
+ "source": "CVE",
+ "id": "CVE-2026-51871",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51871"
+ }
+ ],
+ "references": [
+ {
+ "title": "NVD — CVE-2026-51871",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51871",
+ "type": "advisory"
+ },
+ {
+ "title": "Researcher write-up of CVE-2026-51871 (Ro1ME)",
+ "url": "https://gist.github.com/Ro1ME/3067a5bd69dcd35ffc98dc41ca611242",
+ "type": "research"
+ },
+ {
+ "title": "stitionai/devika issue #714: Code Injection in Runner.execute",
+ "url": "https://github.com/stitionai/devika/issues/714",
+ "type": "disclosure"
+ }
+ ],
+ "tags": [
+ "cve",
+ "tooling-cve",
+ "agentic",
+ "code-execution",
+ "devika",
+ "no-fix",
+ "draft-evidence",
+ "draft-mapping"
+ ],
+ "control_failures": [
+ {
+ "framework": "OWASP ASVS 5.0.0",
+ "control_id": "V1.3.2",
+ "outcome": "absent",
+ "basis": "Accepts LLM-generated commands without sanitization",
+ "source_url": "https://gist.github.com/Ro1ME/3067a5bd69dcd35ffc98dc41ca611242",
+ "confirmed_by": []
+ }
+ ]
}
];
\ No newline at end of file
diff --git a/docs/og-image.svg b/docs/og-image.svg
index 6137dc2..c61baae 100644
--- a/docs/og-image.svg
+++ b/docs/og-image.svg
@@ -34,7 +34,7 @@
MAPPING FILES
- 147
+ 148
INCIDENTS