Unrated severityNVD Advisory· Published Aug 4, 2024· Updated Aug 30, 2024
Injection by Prompt Injection in stitionai/devika
CVE-2024-6331
Description
stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCK_NONE for HarmCategory.HARM_CATEGORY_HATE_SPEECH and HarmCategory.HARM_CATEGORY_HARASSMENT in safety_settings disables content protection. This allows malicious commands to be executed, such as reading sensitive file contents like /etc/passwd.
Affected products
2- stitionai/stitionai/devikav5Range: unspecified
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.