Devika CVE-2026-51871

Exploitation requires a running Devika v1.0 instance whose agent runner reaches Runner.execute, which executes LLM-generated content directly with no sandbox. The concrete trigger is getting attacker-influenced content into the LLM output path - either by interacting with the Devika interface (which ships without authentication) or by prompt injection through external content the agent processes. Limiting factors: realistic unauthenticated remote exploitation assumes the Devika web interface is network-exposed rather than bound to localhost; if access to the agent interface is restricted or the instance is single-user on a workstation, exploitation collapses to local/operator scope. No special non-default feature toggle is needed - direct execution of LLM output is the default behavior of the vulnerable runner.

Signals are mixed and should be read carefully before escalating. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-94 (Code Injection) describe worst-case network, unauthenticated, low-complexity remote code execution with total impact, and SSVC reinforces this with Technical Impact 'total' and Automatable 'yes'. However, EPSS is only 0.23% (13th percentile), indicating a low modeled probability of observed exploitation in the near term, and the vulnerability is NOT in the CISA KEV catalog, so there is no evidence of active exploitation. SSVC exploitation status is 'poc', consistent with the referenced public gist - publicly available exploit code exists, but that is distinct from in-the-wild use. The tension is between a maximal CVSS/SSVC technical profile and low EPSS plus no KEV, which is explained by product footprint rather than exploit difficulty: Devika is a niche open-source agentic-AI research project, so widespread automated exploitation is unlikely despite the flaw being trivially triggerable where deployed. An important caveat: the flaw is architectural - Runner.execute directly executes LLM-generated content - so realistic PR:N exploitation assumes the Devika web interface is network-exposed without authentication (Devika ships without authentication but commonly binds to localhost), or that an attacker can inject malicious instructions into the LLM pipeline via prompt injection. Net: a genuine critical-severity flaw for anyone running Devika, but a low aggregate priority across the broader fleet due to small deployment footprint and no confirmed active exploitation. CPE (cpe:2.3:a:n/a:n/a) and EUVD affected versions ('n/a n/a') are placeholder/unusable - only Devika v1.0 from the description is reliable.

An attacker reaches an exposed or shared Devika v1.0 instance (or seeds malicious content the agent will ingest) and crafts input that steers the LLM into emitting code containing attacker-controlled commands. Because Runner.execute runs LLM-generated content directly without a sandbox, the payload executes on the host with the agent's privileges, yielding arbitrary code execution. A public proof-of-concept exists (referenced gist and GitHub issue #714), lowering the barrier to reproduction.