CVE-2026-51874

Summary

The Devika v1.0 Patcher Agent has a path traversal vulnerability in its save_code_to_project function that allows attackers to write files outside the intended project workspace, potentially leading to arbitrary file creation and code execution.

Exploitability

This vulnerability is relatively easy to exploit as it requires no authentication and can be triggered through a network request with crafted input parameters, making it highly accessible to remote attackers.

Blast radius

If exploited, this vulnerability could allow attackers to write malicious files to critical system locations, potentially leading to persistent backdoors or arbitrary code execution on the server hosting Devika.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Devika v1.1 or later to address this path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.