CVE-2026-51871

Deferred Deferred - Pending Action

Code Injection in Devika AI Agent Framework

Publication date: 2026-09-30

Last updated on: 2026-10-01

Assigner: MITRE

Description

Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-51871

Affected Vendors & Products

Vendor	Product	Version / Range
stitionai	devika	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a code injection flaw in Devika v1.0. It exists in the Runner.execute function located in src/agents/runner/runner.py. The issue allows attackers to execute arbitrary code by directly running content generated by a large language model (LLM).

Detection Guidance

To detect this vulnerability, inspect Devika v1.0 installations for the Runner.execute function in src/agents/runner/runner.py. Check if arbitrary code execution is possible through LLM-generated content. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run malicious code on your system. This could lead to unauthorized access, data theft, system damage, or further compromise of your environment depending on the attacker's goals.

Compliance Impact

The vulnerability allows arbitrary code execution via LLM-generated content, which could lead to unauthorized data access, modification, or exfiltration. This may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Disable direct execution of LLM-generated content in Devika v1.0. Implement input validation and sanitization for all user-provided data. Update to a patched version if available. Monitor network traffic for suspicious activity related to code execution.

Hi! I’m here to help you understand CVE-2026-51871. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70