Devika EUVD-2026-91131

Exploitation requires the ability to reach and drive Devika's code-generation workflow so that attacker-influenced input flows into the Coder.save_code_to_project file path. Devika v1.0 ships without authentication by default, so a network-reachable instance is directly exposed; the practical limiting factor is that Devika is commonly run bound to localhost for a single developer, which removes remote reachability. No non-default feature toggle is needed - the save-to-project functionality is core agent behavior - but the attacker must be able to supply or steer a filename/project path containing traversal sequences (e.g. ../). Realistic risk is therefore gated primarily by whether the instance is network-exposed rather than by any special configuration.

Signals conflict in a way that pulls this below its headline score. The CVSS base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, implying an easy, high-impact network attack - a directory-traversal file-write primitive that typically escalates to remote code execution via overwriting startup scripts or credentials. However, EPSS is only 0.26% (16th percentile), it is NOT on the CISA KEV list, and there is no confirmed active exploitation, so widespread opportunistic attack is currently unlikely. A referenced gist (Ro1ME) and the upstream GitHub issue #707 suggest public technical detail / likely PoC exists, which raises the practical exploitability even as EPSS stays low. The decisive mitigating factor is deployment footprint: Devika is a niche open-source agentic-AI coding tool, not enterprise infrastructure, so the real-world exposed surface is small. Note a tension in the metadata: the vector states PR:L, but Devika ships with no authentication by default, so any network-exposed instance could be exploited unauthenticated (PR:N), which would push severity higher - verify whether the target instance is exposed and whether auth is in front of it. Also, the CPE and affected-version fields are placeholders ('n/a'), so the vulnerable scope is defined only by the description ('Devika v1.0'). Bottom line: genuinely dangerous (file write → RCE) for anyone exposing Devika on a network, but low aggregate risk for most organizations because the product is rarely deployed in production.

An attacker reaches a network-exposed Devika instance (which ships without authentication by default) and drives its code-generation agent to save a file whose target path contains directory-traversal sequences, causing Coder.save_code_to_project to write outside the intended project workspace. By overwriting a sensitive file such as a startup script, cron entry, or SSH authorized_keys, the attacker converts the arbitrary file write into code execution on the host. A public gist referenced in the advisory appears to document the technique, indicating exploit detail is available even though active exploitation is not confirmed.