CVE-2026-51873
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.
Risk Assessment
An attacker can exploit this to write files to unauthorized locations, potentially leading to system integrity compromise.
Recommendation
Update Devika to the latest version and implement protections against directory traversal in the Coder.save_code_to_project function.
Other vulnerabilities in Devika
See all- CVE-2026-51875Critical
In Devika v1.0, the Feature Agent's save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server.
- CVE-2026-51872Critical
Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.
- CVE-2026-51871Critical
Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content.
- CVE-2026-51874High
In Devika v1.0, the Patcher Agent's save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace.
Original NVD description (English source)
Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS