CVE-2026-51875
In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially comprom
n/a n/a
CVSS
9.1CriticalExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 5 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
What fixes it
No source in this snapshot names a fixed version.
Description
In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server.
Text from CVE List
Affected versions 1
- n/aaffected: n/aCVE List