Search results

[Bug] Unvalidated JSON Serialization in AgentStateModel Allows State Spoofing and Evaluation Poisoning

Status: Open.

#717 In stitionai/devika;

· QiuYucheng2003 opened on Jun 19, 2026

[Bug] Critical Path Traversal and Arbitrary File Write in save_code_to_project (feature.py)

Status: Open.

#716 In stitionai/devika;

· QiuYucheng2003 opened on Jun 9, 2026

[Bug]Code Injection in Runner.run_code enables arbitrary code execution via LLM-orchestrated paths

Status: Open.

#715 In stitionai/devika;

· Ro1ME opened on May 23, 2026

[Bug]Code Injection in Runner.execute allows arbitrary code execution through LLM-shaped payloads

Status: Open.

#714 In stitionai/devika;

· Ro1ME opened on May 23, 2026

[Security] Critical Stored XSS via WebSocket CORS Bypass in Devika allows Complete Session Takeover

Status: Open.

#713 In stitionai/devika;

· YLChen-007 opened on May 12, 2026

[Security] Incomplete Fix for CVE-2024-5752: Arbitrary File Write via Unsanitized project_name in WebSocket API

Status: Open.

#712 In stitionai/devika;

· YLChen-007 opened on May 12, 2026

[Security] Unauthenticated WebSocket CORS Bypass Leads to Remote Code Execution via Agent Control

Status: Open.

#711 In stitionai/devika;

· YLChen-007 opened on May 12, 2026

[Bug] Patcher Agent path traversal vulnerability

Status: Open.

#709 In stitionai/devika;

· Ro1ME opened on Apr 20, 2026

[Bug] Feature Agent path traversal vulnerability

Status: Open.

#708 In stitionai/devika;

· Ro1ME opened on Apr 20, 2026

[Bug] Coder Agent path traversal vulnerability

Status: Open.

#707 In stitionai/devika;

· Ro1ME opened on Apr 20, 2026

[FEATURE] One should update supported LLM models manually ?

Status: Open.

#695 In stitionai/devika;

· kviksna-g8 opened on Sep 16, 2025

Potential Command Injection Vulnerability: Unvalidated Commands Generated by LLM

Status: Open.

#693 In stitionai/devika;

· glmgbj233 opened on Jul 9, 2025