TI-2024-05305 Aliases CVE-2024-5711 GHSA-wwj9-v5mc-qrpm

Stored XSS in stitionai/devika

MEDIUM 60CWE-79Published 2024-07-08 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A stored Cross-Site Scripting (XSS) vulnerability exists in the stitionai/devika chat feature, allowing attackers to inject malicious payloads into the chat input. This vulnerability is due to the lack of input validation and sanitization on both the frontend and backend components of the application. Specifically, the application fails to sanitize user input in the chat feature, leading to the execution of arbitrary JavaScript code in the context of the user's browser session. This issue affects all versions of the application. The impact of this vulnerability includes the potential for stolen credentials, extraction of sensitive information from chat logs, projects, and other data accessible through the application.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00477 41st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed stitionai/devika (stitionai): -

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
stitionai	stitionai/devika	before -	-	Patch available	CNA

stitionai/devika Vendorstitionai Affected before - Fixed in - Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:stitionai:devika:-:::::::*	not specified by NVD	Vulnerable	stitionai

cpe:2.3:a:stitionai:devika:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·stitionai

Remediation

Fix · CNA stitionai/devika (stitionai) Fixed in -

Timeline

2026-10-02 Threatist record created from CVE-2024-5711
2026-10-03 Alias added: GHSA-wwj9-v5mc-qrpm

References

Exploit 1

https://huntr.com/bounties/6c00ff84-574b-4b4f-bd58-aa7ec1809662

Patch 1

https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2

TI-2024-26916 The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika… CVSS 3.1CRITICAL 9.1
TI-2024-05493 Path Traversal in stitionai/devika CVSS 3.0CRITICAL 9.1
TI-2024-05156 Directory Traversal in stitionai/devika CVSS 3.0HIGH 7.5
TI-2024-05155 Directory Traversal in stitionai/devika CVSS 3.0HIGH 7.5
TI-2024-04953 Local File Read in stitionai/devika CVSS 3.0HIGH 7.5
TI-2024-05397 Unprotected WebSocket in stitionai/devika CVSS 3.1HIGH 8.8

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences