High severity7.5NVD Advisory· Published Aug 4, 2024· Updated Jun 17, 2026
CVE-2024-6331
CVE-2024-6331
Description
stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCK_NONE for HarmCategory.HARM_CATEGORY_HATE_SPEECH and HarmCategory.HARM_CATEGORY_HARASSMENT in safety_settings disables content protection. This allows malicious commands to be executed, such as reading sensitive file contents like /etc/passwd.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: BLOCK_NONE
- stitionai/stitionai/devikav5Range: unspecified
Patches
Vulnerability mechanics
References
1- huntr.com/bounties/d5ac1051-22fa-42f0-8d82-73267482e60fnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.