PT-2025-12161 · Devika · Devika

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-5752

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions stitutionai/devika version beacf6edaa205a5a5370525407a6db45137873b3

Description A path traversal issue exists in the project creation functionality, where the project name is not validated. This allows an attacker to create a project with a crafted name that traverses directories, potentially leading to arbitrary file overwrite when the application generates code and saves it to the specified project directory. This could result in remote code execution.

Recommendations For version beacf6edaa205a5a5370525407a6db45137873b3, consider validating project names to prevent directory traversal, and ensure that generated code is saved to a secure, non-accessible location until a patch is available. As a temporary workaround, restrict the project creation functionality to authorized users only.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-5752

Affected Products

Devika

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-5752 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5752 · Vendor Advisory
• https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2 · Note
• https://huntr.com/bounties/865b5f44-ef75-4243-a5f1-2f0d895353b1 · Note
• https://twitter.com/CVEnew/status/1902670996408275277 · Twitter Post