The vulnerability resides in the Runner.execute function of Devika v1.0, where LLM‑generated content is executed directly without validation. This flaw can allow an attacker to inject arbitrary code, giving them the ability to run any commands on the host system. The weakness is a classic code‑injection scenario, enabling full compromise of confidentiality, integrity, and availability of the affected environment.

Devika v1.0, a generative‑AI‑driven automation tool, is the only product identified as affected. No vendor or version range beyond v1.0 is specified, so any instance of this release is potentially vulnerable.

The EPSS score is <1% and the CVSS score is 9.8, and the vulnerability is not listed in CISA's KEV catalog, suggesting that exploitation data is currently unknown. However, the nature of the flaw—unrestricted execution of LLM output—means that exploitation is feasible with minimal effort once the attacker controls the content fed to Runner.execute. The likely attack vector is indirect through any component that can supply LLM output to the function, such as user‑supplied prompts or external data feeds.