This issue allows an attacker to inject and execute arbitrary code through the Runner.run_code function in Devika v1.0. The vulnerability arises when user supplied input is passed directly to the code execution engine without proper sanitization, enabling execution of unintended commands and disclosure of application secrets. The potential impact includes full compromise of the host environment if the runner is run with elevated privileges, or unrestricted data exfiltration if attacked through unauthorized channels.

Only Devika version 1.0 is affected. No specific vendor or corporate product names are listed, but any deployment of this version that exposes the Runner.run_code endpoint to external input is at risk.

The exploit requires the ability to pass custom code to Runner.run_code. In typical deployments this might be achievable via exposed APIs or local configuration files, suggesting a local or remote code execution vector, depending on the operating context. The EPSS score indicates <1% probability of exploitation, and the CVSS score of 9.8 underscores the severity of arbitrary code execution despite its low likelihood of being actively exploited; however, precautions are recommended. The attacker would need to trigger the vulnerable function, which may be straightforward if the interface is publicly accessible.