CVE-2026-51873

Summary

Devika v1.0 allows attackers to write files outside the intended project workspace through a directory traversal vulnerability, enabling unauthorized file manipulation.

Exploitability

Exploitation requires knowledge of the target project directory structure and access to the Coder.save_code_to_project function. Precondition is the attacker must have low-level privileges.

Blast radius

If exploited, attackers could gain control over files outside the project workspace, potentially leading to data loss or system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Devika v2.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.