Search results

[Security] Critical Stored XSS via WebSocket CORS Bypass in Devika allows Complete Session Takeover

Status: Open.

#713 In stitionai/devika;

· YLChen-007 opened on May 12, 2026

[Security] Incomplete Fix for CVE-2024-5752: Arbitrary File Write via Unsanitized project_name in WebSocket API

Status: Open.

#712 In stitionai/devika;

· YLChen-007 opened on May 12, 2026

[Security] Unauthenticated WebSocket CORS Bypass Leads to Remote Code Execution via Agent Control

Status: Open.

#711 In stitionai/devika;

· YLChen-007 opened on May 12, 2026

[Bug] Patcher Agent path traversal vulnerability

Status: Open.

#709 In stitionai/devika;

· Ro1ME opened on Apr 20, 2026

[Bug] Feature Agent path traversal vulnerability

Status: Open.

#708 In stitionai/devika;

· Ro1ME opened on Apr 20, 2026

[Bug] Coder Agent path traversal vulnerability

Status: Open.

#707 In stitionai/devika;

· Ro1ME opened on Apr 20, 2026

[FEATURE] One should update supported LLM models manually ?

Status: Open.

#695 In stitionai/devika;

· kviksna-g8 opened on Sep 16, 2025

Potential Command Injection Vulnerability: Unvalidated Commands Generated by LLM

Status: Open.

#693 In stitionai/devika;

· glmgbj233 opened on Jul 9, 2025

CORS policy triggered

Status: Open.

#686 In stitionai/devika;

· kviksna opened on Mar 10, 2025

is this project abandoned?

Status: Open.

#685 In stitionai/devika;

· athuljayaram opened on Mar 1, 2025

[Security Bug] Path Traversal Vulnerability in the API.

Status: Open.

#681 In stitionai/devika;

· slash0x99 opened on Jan 29, 2025

Possible issue with Ollama version and response format

Status: Open.

#679 In stitionai/devika;

· windprince opened on Jan 15, 2025