Devika EUVD-2026-91130

Requires a running Devika instance whose Patcher Agent (save_code_to_project) is invoked on attacker-influenceable input - i.e. the attacker must be able to submit or steer a coding task so that attacker-controlled file paths containing ../ traversal sequences are passed to the save routine. Exploitation is bounded by deployment reality rather than by authentication: Devika is typically self-hosted by a single developer and often not exposed to untrusted networks, so the practical attack surface depends on whether the instance is network-reachable and whether its agent processes externally-supplied tasks or repository content. The CVSS vector asserts no authentication (PR:N) and no user interaction, but this holds only for instances deployed without access controls in front of the agent interface.

Signals are mixed and skew toward lower real-world urgency than the 7.5 base score suggests. The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, unauthenticated, low-complexity write primitive, and SSVC rates it Automatable:yes with partial technical impact - on paper an attractive target. Against that, EPSS is only 0.15% (4th percentile), there is no CISA KEV listing, and exploitation status is limited to a publicly available proof-of-concept (SSVC Exploitation:poc, corroborated by the referenced gist). The AV:N/PR:N rating should be treated cautiously: Devika is a self-hosted agentic AI developer tool normally run locally by an individual, so 'network, unauthenticated' exploitation presupposes an exposed instance whose Patcher Agent an attacker can feed crafted input to - a condition the terse description does not confirm. CWE-22 with C:N/I:H/A:N is internally consistent (arbitrary file write = integrity loss, no direct disclosure). Net: a legitimate high-severity integrity flaw, but currently a patch-in-normal-cycle issue rather than an emergency - low EPSS, no active-exploitation evidence, and a niche/experimental deployment base all argue against widespread opportunistic attacks. Verify network exposure and auth posture against your actual Devika deployment before rating it network-remote.

An attacker who can submit tasks to or otherwise influence the output of a running Devika instance's Patcher Agent supplies a file path containing traversal sequences (e.g. ../../), causing save_code_to_project to write attacker-controlled content outside the intended project workspace - for example overwriting a startup script, SSH key, or configuration file to achieve code execution or privilege escalation on the host. A public proof-of-concept exists (referenced gist and GitHub issue #709), lowering the barrier to reproduction.