Stitionai maintains a focused product portfolio centered on Devika, an AI-assisted development platform, where the vulnerability profile skews toward serious outcomes with an elevated share reaching critical severity and frequently acquiring public exploit code. The recurring exposure centers on web application and file-handling weakness classes including path traversal, cross-site scripting, CSRF, and injection flaws that reflect the platform's web-facing architecture and file-system interaction surface. Defenders should prioritize updates for this vendor's platform components given the severity tendency; live exploitation and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Stitionai over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-40422CRITICAL The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path | Jul 24, 2024 | 9.1 | 52 | NO | YES |
CVE-2024-5334HIGH A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parame | Jun 27, 2024 | 7.5 | 30 | NO | YES |
CVE-2024-5926CRITICAL A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service | Jun 30, 2024 | 9.1 | 26 | NO | NO |
CVE-2024-5820HIGH An unprotected WebSocket connection in the latest version of stitionai/devika (commit ecee79f) allows a malicious website to connect to the backend and issue commands on behalf of | Jun 27, 2024 | 8.8 | 24 | NO | NO |
CVE-2024-5712HIGH A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the latest version. This vulnerability allows attackers to perform u | Jun 28, 2024 | 8.1 | 23 | NO | NO |
CVE-2024-5549HIGH A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys | Jul 9, 2024 | 8.1 | 22 | NO | NO |
CVE-2024-5548HIGH A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by m | Jun 27, 2024 | 7.5 | 21 | NO | NO |
CVE-2024-6331MEDIUM stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection. The integration of Google Gimini 1.0 | Aug 4, 2024 | 6.5 | 20 | NO | NO |
CVE-2024-5547HIGH A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vulnerability arises due | Jun 27, 2024 | 7.5 | 20 | NO | NO |
CVE-2024-5711MEDIUM A stored Cross-Site Scripting (XSS) vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloads into the chat input. This vulnerabili | Jul 8, 2024 | 6.1 | 18 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Stitionai.
Media articles that mention a CVE ID that affects a product developed by Stitionai — matched by CVE ID, not by vendor name.