EUVD-2026-90411
GHSA-pxxm-r9vp-9cmm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Devika backend API
-
DeliverySubmit crafted agent task input
-
ExploitInject payload into Runner.run_code
-
ExecutionExecute arbitrary code on host
-
ImpactFull compromise of developer environment
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reachability to the Devika backend service that routes user or agent input into the Runner.run_code function; Devika ships with no authentication layer, so any actor who can reach that API can inject code with no credential or user-interaction barrier. The practical limiting factor is network exposure: Devika is normally run as a local developer tool bound to localhost, so the remote unauthenticated exploitation implied by AV:N/PR:N applies only when the operator has deliberately exposed the backend on a network interface (e.g. 0.0.0.0) or runs it in a shared, multi-user environment. Affected version is reported as v1.0. |
| Impact | Signals conflict and warrant careful reading. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes trivially exploitable unauthenticated remote code execution, which SSVC would map to automatable exploitation with total technical impact. However, EPSS is only 0.21% (10th percentile), the CVE is NOT in CISA KEV, and the affected product (Devika, an open-source AI software-engineering agent) is an experimental developer tool rather than an internet-exposed enterprise service. The low EPSS alongside a 9.8 base score reflects a classic high-CVSS-but-low-real-world-risk pattern: the flaw is genuinely severe where reachable, but Devika is typically run locally on a developer workstation bound to localhost, so the AV:N/PR:N assumption only holds if the operator has intentionally exposed the backend to the network. A referenced GitHub gist (Ro1ME) and the project issue tracker (#715) appear to contain a proof-of-concept or write-up, but there is no evidence of active exploitation. Net: a real code-execution bug worth patching on any exposed or multi-user Devika deployment, but not a mass-exploitation priority given niche footprint and default-local binding - verify network exposure before escalating. |
| Exploit ScenarioDerived | An attacker who can reach the Devika backend API submits a crafted agent task or input that is passed into Runner.run_code in src/agents/runner/runner.py, which executes it as code on the host. Because Devika ships without authentication, any party able to reach the service - for example a Devika instance exposed on 0.0.0.0 or shared on a LAN - gains arbitrary code execution. A proof-of-concept or write-up is referenced in a public GitHub gist and issue #715, lowering the skill needed to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Unauthenticated code injection in Devika v1.0 allows an attacker who can reach the backend service to run arbitrary code with the privileges of the Devika process, because the Runner.run_code function in src/agents/runner/runner.py executes supplied input without adequate validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) reflects a remotely reachable, no-authentication, no-interaction path, but practical risk is bounded by deployment: Devika is normally run as a local developer tool bound to localhost, and the network-facing exploitation implied by the vector applies only when an operator has deliberately bound the backend to a routable interface (for example 0.0.0.0) or runs it in a shared multi-user environment. EPSS is low at 0.21% (roughly the 10th percentile) and no public exploit was identified at time of analysis, with no CISA KEV entry; a public GitHub issue and an external gist are the only public artifacts referenced alongside the MITRE and ENISA EUVD (EUVD-2026-90411) records.
RemediationAI
No vendor-released patch was identified at time of analysis, and the reference set (upstream issue github.com/stitionai/devika/issues/715, an external gist, and the NVD detail page) contains no fixed-version tag, so remediation must start with compensating controls until an advisory or patched release appears. The single highest-value action is to remove network exposure from the Devika backend: bind it explicitly to 127.0.0.1 rather than 0.0.0.0 and confirm with a listening-socket check, which eliminates the AV:N path entirely at the cost of breaking any intended remote or container-to-container access. Where remote access is genuinely required, place the service behind an authenticating reverse proxy or VPN and block the backend port at the host firewall so only that proxy can reach it, accepting the operational overhead of credential management that Devika itself does not provide. Treat the runner as untrusted execution: run Devika inside a dedicated container or VM under a least-privilege user with no host mounts, restricted outbound egress, and seccomp/AppArmor confinement, understanding that this limits blast radius rather than preventing the injection itself and may break workflows that legitimately need host files, toolchains, or network access. Finally, restrict the Devika UI/API to a single trusted operator, review any queued or historical agent tasks for injected content, and monitor the upstream repository for a fixed release so these controls can be retired once a patched version is confirmed and deployed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-94 (Improper Control of Generation of Code / Code Injection): user- or agent-supplied content reaches a code-execution sink without sanitization or sandboxing. Devika is an open-source agentic software-engineering assistant that orchestrates LLM-driven planning and then hands generated Python to a runner subsystem; Runner.run_code in src/agents/runner/runner.py is that execution primitive, so anything able to influence its input arguments controls what the host interpreter executes. Because the vulnerable code path is the same path the product uses by design to run generated code, the boundary between intended functionality and exploitation depends entirely on who can reach the API and what isolation the runner has, not on a memory-safety defect. The supplied CPE string is a placeholder (cpe:2.3:a:n/a:n/a), so affected-product identification rests on the reported version Devika v1.0 and the ENISA EUVD entry, whose affected-version field is also unpopulated; there is no vendor CPE to map against and no CNA-provided version range beyond v1.0.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Devika has no authentication so PR:N and AC:L, and code injection via run_code yields full host RCE (C/I/A:H); AV:N holds only where the backend is network-exposed.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.
Executive ViewAI
Devika v1.0 contains a critical unauthenticated code injection flaw that can let anyone who can reach its backend run arbitrary code with the Devika process's privileges. The risk is concentrated in developer workstations or shared environments where the backend has been bound beyond localhost; a compromise could expose source code, credentials, and internal systems, making it a leadership concern for engineering and security teams. No vendor-released patch was identified at time of analysis, and no public exploit was identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: bind the Devika v1.0 backend to localhost only and never to 0.0.0.0; block network access via host or network firewall; run in an isolated container or VM with least privilege, no sensitive credentials, and restricted egress; monitor logs for Runner.run_code abuse; rotate secrets on any potentially exposed host; consider disabling or sandboxing code-execution features until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB