Skip to content

incidents: add INC-148, Devika Runner.execute runs LLM-generated commands (CVE-2026-51871) #223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
emmanuelgjr wants to merge 1 commit into
base: main
Choose a base branch
from
Open

incidents: add INC-148, Devika Runner.execute runs LLM-generated commands (CVE-2026-51871) #223

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ node scripts/incidents-report.js --format stix # SIEM/SOAR export
| **Red teamer** | [LAAF guide](evals/laaf/README.md) → run S1–S6 attack stages, map results to OWASP |
| **GRC / auditor** | `compliance-report.js --format oscal` → import into ServiceNow/Archer |
| **Developer** | `npm install genai-security-crosswalk` → query risks + controls programmatically |
| **Threat intel analyst** | `incidents-report.js --format stix` → ingest <!-- stats:incidents -->147<!-- /stats --> AI incidents into Sentinel/Splunk |
| **Threat intel analyst** | `incidents-report.js --format stix` → ingest <!-- stats:incidents -->148<!-- /stats --> AI incidents into Sentinel/Splunk |

---

Expand Down Expand Up @@ -178,7 +178,7 @@ Every file answers one question: **which controls from framework X address vulne
| **70+** open-source tools | Catalogued and organised by function |
| **25** eval profiles | Runnable Garak (13) + PyRIT (6) + LAAF (6) tests mapped to OWASP entries |
| **<!-- stats:frameworks-mapped -->26<!-- /stats -->** compliance reports | Per-framework gap assessments auto-generated from data layer (MD, CSV, JSON, OSCAL) |
| **<!-- stats:incidents -->147<!-- /stats -->** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) |
| **<!-- stats:incidents -->148<!-- /stats -->** documented incidents | Real-world + research incidents with MAESTRO layer attribution (MD, CSV, JSON, STIX 2.1) |
| **LAAF v2.0** | First agentic LPCI red-teaming framework — fully integrated with 6-stage × OWASP crosswalk |

All free. All open-source. Built for practitioners.
Expand Down Expand Up @@ -432,7 +432,7 @@ crosswalk/
│
├── data/
│ ├── schema.json ← JSON Schema (Draft 7) for entry files
│ ├── incidents.json ← <!-- stats:incidents -->147<!-- /stats --> incidents with MAESTRO layer attribution
│ ├── incidents.json ← <!-- stats:incidents -->148<!-- /stats --> incidents with MAESTRO layer attribution
│ ├── incidents-schema.json ← JSON Schema for incidents
│ ├── tools-supplement.json ← Supplemental tools merged at generation time
│ ├── entries/ ← <!-- stats:entries -->51<!-- /stats --> machine-readable entry JSON files
Expand Down Expand Up @@ -517,7 +517,7 @@ See `evals/laaf/README.md` for the full LPCI attack vector → OWASP → MAESTRO

## Incident tracker

The tracker holds <!-- stats:incidents -->147<!-- /stats --> real-world and research-demonstrated incidents, each
The tracker holds <!-- stats:incidents -->148<!-- /stats --> real-world and research-demonstrated incidents, each
mapped to OWASP entries and MAESTRO architectural layers:

```bash
Expand All @@ -543,7 +543,7 @@ No install required. Works on desktop and mobile.
| [**Score**](https://genai-security-project.github.io/crosswalk/#/score) | Select your frameworks, see coverage gaps. Upload Garak/PyRIT/LAAF results to validate. Share your score card on LinkedIn. |
| [**Explorer**](https://genai-security-project.github.io/crosswalk/#/explorer) | Search and filter all <!-- stats:entries -->51<!-- /stats --> entries. Click any entry to see controls across all <!-- stats:frameworks-mapped -->26<!-- /stats --> frameworks. |
| [**Frameworks**](https://genai-security-project.github.io/crosswalk/#/frameworks) | Interactive <!-- stats:entries -->51<!-- /stats -->×<!-- stats:frameworks-mapped -->26<!-- /stats --> coverage matrix. Click any cell to see the specific controls mapped. |
| [**Incidents**](https://genai-security-project.github.io/crosswalk/#/incidents) | Browse <!-- stats:incidents -->147<!-- /stats --> AI security incidents. Filter by severity, year, MAESTRO layer. Full attribution details. |
| [**Incidents**](https://genai-security-project.github.io/crosswalk/#/incidents) | Browse <!-- stats:incidents -->148<!-- /stats --> AI security incidents. Filter by severity, year, MAESTRO layer. Full attribution details. |

**Evidence-based scoring** — three validation tiers:

Expand Down
15 changes: 14 additions & 1 deletion data/entries/ASI05.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -329,7 +329,14 @@
"notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review",
"framework_version": "ASVS 5.0.0",
"confidence": "unreviewed",
"reviewed_by": []
"reviewed_by": [],
"evidence_count": 0,
"evidence": {
"confirmed": [],
"drafted": [
"INC-148"
]
}
},
{
"framework": "OWASP ASVS 5.0.0",
Expand Down Expand Up @@ -1173,6 +1180,12 @@
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-132"
},
{
"name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-148"
}
],
"crossrefs": {
Expand Down
6 changes: 6 additions & 0 deletions data/entries/LLM01.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1444,6 +1444,12 @@
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-147"
},
{
"name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-148"
}
],
"crossrefs": {
Expand Down
15 changes: 14 additions & 1 deletion data/entries/LLM10.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,7 +267,14 @@
"notes": "No eval or dynamic code execution of LLM-generated content",
"framework_version": "ASVS 5.0.0",
"confidence": "unreviewed",
"reviewed_by": []
"reviewed_by": [],
"evidence_count": 0,
"evidence": {
"confirmed": [],
"drafted": [
"INC-148"
]
}
},
{
"framework": "OWASP ASVS 5.0.0",
Expand Down Expand Up @@ -1074,6 +1081,12 @@
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2024,
"incident_id": "INC-075"
},
{
"name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-148"
}
],
"crossrefs": {
Expand Down
82 changes: 82 additions & 0 deletions data/incidents.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9529,6 +9529,88 @@
"confirmed_by": []
}
]
},
{
"id": "INC-148",
"title": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
"date": "2026-09",
"year": 2026,
"category": "research-demonstrated",
"incident_class": "tooling-cve",
"severity": "Critical",
"description": "CVE-2026-51871, published 2026-09-30, states that \"Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content.\" Devika is an open-source AI software-engineering agent. At the repository's head, Runner.execute takes the commands from the model's response and run_code runs each one with subprocess.run in the project directory; the only check is that the response contains a commands field. The researcher's write-up gives the attack surface as the Socket.IO service entry and the root cause as \"Accepts LLM-generated commands without sanitization\". Provenance is thin, as for INC-132: the CNA is MITRE rather than the vendor; NVD lists the record as Deferred with no score of its own; the CVSS 3.1 score of 9.8 (Critical) is a secondary metric from the CISA ADP, which records SSVC exploitation as \"poc\"; and there is no vendor advisory or fix. The upstream issue (stitionai/devika#714, opened 2026-05-23) is still open, the repository publishes no releases or tags, and its last push was 2025-09-25. The record is included because the CVE is published and its mechanism is stated and visible in the source; the evidence behind the score is not the vendor's.",
"owasp_entries": [
"ASI05",
"LLM10",
"LLM01"
],
"mapping_status": "draft",
"maestro_layers": [
{
"layer": "L3",
"label": "Agent Frameworks",
"role": "origin",
"notes": "The agent runner passes commands from the model response straight to subprocess.run"
},
{
"layer": "L4",
"label": "Deployment & Infrastructure",
"role": "impact",
"notes": "Commands run on the host with the service's permissions"
}
],
"attack_vector": "Messages to the agent through its Socket.IO service entry shape the model's response, whose commands field Runner.execute runs with subprocess.run",
"affected": "Devika v1.0, as named by the CVE; the repository publishes no releases or tags",
"impact": "Arbitrary command execution on the host running Devika, with the service's permissions",
"mitigations": [
"No fix is available; do not expose the Devika service to untrusted users or networks",
"Treat model-generated commands as untrusted input: allow-list them, or require human approval before execution",
"Run the agent in a sandbox with no host filesystem, credential or network reach"
],
"external_refs": [
{
"source": "CVE",
"id": "CVE-2026-51871",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51871"
}
],
"references": [
{
"title": "NVD — CVE-2026-51871",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51871",
"type": "advisory"
},
{
"title": "Researcher write-up of CVE-2026-51871 (Ro1ME)",
"url": "https://gist.github.com/Ro1ME/3067a5bd69dcd35ffc98dc41ca611242",
"type": "research"
},
{
"title": "stitionai/devika issue #714: Code Injection in Runner.execute",
"url": "https://github.com/stitionai/devika/issues/714",
"type": "disclosure"
}
],
"tags": [
"cve",
"tooling-cve",
"agentic",
"code-execution",
"devika",
"no-fix",
"draft-evidence",
"draft-mapping"
],
"control_failures": [
{
"framework": "OWASP ASVS 5.0.0",
"control_id": "V1.3.2",
"outcome": "absent",
"basis": "Accepts LLM-generated commands without sanitization",
"source_url": "https://gist.github.com/Ro1ME/3067a5bd69dcd35ffc98dc41ca611242",
"confirmed_by": []
}
]
}
]
}
10 changes: 5 additions & 5 deletions data/stats.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,15 +63,15 @@
}
},
"incidents": {
"total": 147
"total": 148
},
"evidence": {
"incidents_annotated": 24,
"control_failures": 34,
"incidents_annotated": 25,
"control_failures": 35,
"confirmed": 0,
"drafted": 34,
"drafted": 35,
"mappings_with_confirmed_evidence": 0,
"mappings_with_drafted_evidence_only": 29,
"mappings_with_drafted_evidence_only": 31,
"orphan_failures": 5
},
"freshness": {
Expand Down
2 changes: 1 addition & 1 deletion docs/banner.svg
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
36 changes: 34 additions & 2 deletions docs/data.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1448,6 +1448,12 @@ window.CROSSWALK_DATA = [
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-147"
},
{
"name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-148"
}
],
"crossrefs": {
Expand Down Expand Up @@ -11029,7 +11035,14 @@ window.CROSSWALK_DATA = [
"notes": "No eval or dynamic code execution of LLM-generated content",
"framework_version": "ASVS 5.0.0",
"confidence": "unreviewed",
"reviewed_by": []
"reviewed_by": [],
"evidence_count": 0,
"evidence": {
"confirmed": [],
"drafted": [
"INC-148"
]
}
},
{
"framework": "OWASP ASVS 5.0.0",
Expand Down Expand Up @@ -11836,6 +11849,12 @@ window.CROSSWALK_DATA = [
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2024,
"incident_id": "INC-075"
},
{
"name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-148"
}
],
"crossrefs": {
Expand Down Expand Up @@ -18492,7 +18511,14 @@ window.CROSSWALK_DATA = [
"notes": "No eval or exec of agent-generated code — absolute prohibition enforced in code review",
"framework_version": "ASVS 5.0.0",
"confidence": "unreviewed",
"reviewed_by": []
"reviewed_by": [],
"evidence_count": 0,
"evidence": {
"confirmed": [],
"drafted": [
"INC-148"
]
}
},
{
"framework": "OWASP ASVS 5.0.0",
Expand Down Expand Up @@ -19336,6 +19362,12 @@ window.CROSSWALK_DATA = [
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-132"
},
{
"name": "Devika agent: LLM-generated commands executed without validation in Runner.execute",
"url": "https://github.com/GenAI-Security-Project/crosswalk/blob/main/data/incidents.json",
"year": 2026,
"incident_id": "INC-148"
}
],
"crossrefs": {
Expand Down
Loading
Loading