Devika: Code injection in Runner.run_code enables arbitrary code execution

Summary

Devika v1.0, an open-source agentic AI software engineer, passes LLM-generated content to the Runner.run_code function in src/agents/runner/runner.py without validation, sandboxing or whitelisting. An attacker who can influence the LLM through crafted prompts can make Devika execute arbitrary code with the privileges of the service, which may lead to full host compromise. The CVSS vector indicates a network-reachable attack without authentication or user interaction; the score is provisional because NVD status is Deferred.

Affected

• Devika v1.0
• Component: src/agents/runner/runner.py (Runner.run_code)
• Other versions: Unknown.

Fixed in

Unknown. No vendor fix or advisory found at time of writing.

Workaround

• Run Devika under a restricted user account with minimal permissions.
• Do not expose Devika to untrusted networks.
• Run it in an isolated VM or container without access to production secrets or networks.

Exploitation

• CISA SSVC (CVE record): exploitation status 'poc', automatable 'yes', technical impact 'total'.
• A public proof of concept is indicated but not verified.
• No known exploitation in the wild reported.

Our recommendation

• Inventory all Devika instances, including developer workstations and test servers.
• Remove network exposure and run instances isolated with minimal privileges.
• Do not process sensitive code or credentials with Devika until a fix is available.
• Monitor for unexpected child processes spawned by Devika.
• Check the vendor issue and repository for a fix and re-check NVD once the record is processed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-51872 GitHub gist (Ro1ME) gist.github.com
• Devika GitHub issue #715 github.com
• VulDB CVE-2026-51872 vuldb.com
• CVE JSON record (cvelistV5) raw.githubusercontent.com
• Strix CVE-2026-51872 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:41.