Devika: Code injection in Runner.execute allows arbitrary code execution
Summary
Devika v1.0, an open-source AI software engineering agent, contains a code injection flaw in the Runner.execute function. The function forwards LLM-generated commands for execution without validation, sanitization or sandboxing. An attacker who can get malicious content into the model output may execute arbitrary commands with the privileges of the Devika process, which can lead to full compromise of that system.
Affected
- Devika v1.0
- Affected component: src/agents/runner/runner.py (Runner.execute)
- Vendor and version range: Unknown.
Fixed in
Unknown. No vendor advisory or fixed release has been identified.
Workaround
- Do not execute LLM-generated content directly; treat all model output as untrusted (recommendation from the reporter's issue).
- Run Devika only in an isolated VM or container without access to production secrets or networks.
- Do not point Devika at untrusted web content or repositories.
- Restrict outbound network access and remove Devika from servers reachable by others.
Exploitation
- CISA SSVC: exploitation 'poc', automatable 'yes', technical impact 'total'.
- Not listed in CISA KEV.
- A public reproduction is described in issue #714; sources conflict on public exploit code and it could not be verified independently.
- In-the-wild exploitation: Unknown.
Our recommendation
- Inventory all Devika instances in the organisation.
- Isolate any instance immediately and restrict its network access.
- Verify whether the web interface requires authentication and whether it is reachable from untrusted networks.
- Keep Devika away from systems holding credentials, source code with secrets, or cloud keys.
- Monitor the vendor repository and NVD for a fix and re-check the status, as NVD analysis is currently deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (CVE JSON, CNA and CISA-ADP) raw.githubusercontent.com
- Reporter issue #714 github.com
- Reporter gist gist.github.com
- Vulners VulnRichment entry vulners.com
- Earlier related issue #693 github.com
- TheHackerWire CVE-2026-51871 www.thehackerwire.com
- Devika project description github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:44.
Original description (NVD)
Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.