TI-2024-05157 Aliases CVE-2024-5549 GHSA-33q6-4f6h-v2vh

Data leak through CORS misconfiguration in stitionai/devika

HIGH 70CWE-346Published 2024-07-09 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability also enables attackers to perform actions on behalf of the user, such as deleting projects or sending messages. The issue arises from the lack of proper origin validation, allowing unauthorized cross-origin requests to be executed. The vulnerability is present in all versions of the repository, as no fixed version has been specified.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00291 21st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed stitionai/devika (stitionai): -

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
stitionai	stitionai/devika	before -	-	Patch available	CNA

stitionai/devika Vendorstitionai Affected before - Fixed in - Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:stitionai:devika:1.0:::::::*	1.0	Vulnerable	stitionai

cpe:2.3:a:stitionai:devika:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·stitionai

Remediation

Fix · CNA stitionai/devika (stitionai) Fixed in -

Timeline

2026-10-02 Threatist record created from CVE-2024-5549
2026-10-03 Alias added: GHSA-33q6-4f6h-v2vh

References

Exploit 1

https://huntr.com/bounties/7ffeb896-27c8-429d-b241-4f7d6dda0afd

Patch 1

https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2

TI-2024-26916 The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika… CVSS 3.1CRITICAL 9.1
TI-2024-05493 Path Traversal in stitionai/devika CVSS 3.0CRITICAL 9.1
TI-2024-05156 Directory Traversal in stitionai/devika CVSS 3.0HIGH 7.5
TI-2024-05155 Directory Traversal in stitionai/devika CVSS 3.0HIGH 7.5
TI-2024-04953 Local File Read in stitionai/devika CVSS 3.0HIGH 7.5
TI-2024-05397 Unprotected WebSocket in stitionai/devika CVSS 3.1HIGH 8.8

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences