CVE-2024-5821: Stitionai Devika

Medium severity, CVSS 6.2. EPSS: 0.2% chance of exploitation in the next 30 days.

The vulnerability allows an attacker to access sensitive files on the server by confusing the agent with incorrect file names. When a user requests the content of a file with a misspelled name, the agent attempts to correct the command and inadvertently reveals the content of the intended file, such as /etc/passwd. This can lead to unauthorized access to sensitive information and potential server compromise.

Affected products

• Stitionai Devika: any version
• Stitionai Stitionai/devika: affected versions not specified

Published 2024-07-03. Last modified 2026-06-17.