A CVSS 10.0 Landed Over the Weekend — Cognition Open-Sources Devin's Vulnerability-Fixing Skill for Free, and Made It Run on Claude Code and Cursor Too

On October 21, 2026, PHP and Node.js both shipped fixes for critical vulnerabilities that could allow remote code execution. As the week turned over, a top-severity hole was also found in the self-hosted edition of GitLab, carrying the maximum CVSS score — and plenty of teams surely lost their weekend to it. The very next day, Cognition, the company behind the coding agent Devin, released an extension called "Vulnerability Fixes" that hands this kind of remediation work off to an agent — open-source and free. What catches the eye is that it isn't Devin-only: it runs as-is on other vendors' agents such as Claude Code and Cursor.

Folding the "How to Fix It" Into Three Skills

The extension bundles three "Agent Skills" — the procedural playbooks you hand an agent. The vulnerabilities it covers, along with the versions deemed safe, are as follows. All of them are high-priority holes that can lead to unauthenticated remote code execution.

No Rewriting on Its Own — It Goes "Survey → Approve → PR"

With the most critical holes, "just bump to the latest version and be done with it" is exactly what invites outages. This extension is designed not to touch code outright, but to proceed in stages.

1. A read-only inventory: It scans across Dockerfiles, distro packages, CI pipelines, Helm values, Terraform, and more to map out where the affected runtimes are actually running.
2. An approval gate: It presents what it found and waits for the user to choose. Risky updates that cross major or minor versions are flagged.
3. Verified updates: Before rewriting anything, it checks tags, digests, and checksums against the official registries.
4. Before-and-after testing: It runs the existing tests against production-equivalent images both before and after the update, and compares the behavior.
5. One PR per repository: It opens a focused pull request that includes the version comparison, test results, a risk summary, and rollback steps.

Splitting the work into one repo = one PR, rather than "update everything in one sweep," is practical. It aligns the unit of review and rollback, and makes runaway behavior less likely even in unattended operation.

What It Means to Drop the Devin-Only Approach

The extension isn't some special proprietary format — it's written in the standard "Agent Skills" format (the mechanism that reads a SKILL.md). That means it runs as-is not just on Devin, but on more than 70 agents, including Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, and OpenCode. Installation is a single line, npx skills add CognitionAI/devin-vuln-fixes; with Claude Code, you can add it as a plugin.

Agent Skills was originally built by one company and later donated to a neutral foundation, where it is being established as a "common standard." Here we have a concrete example of operational know-how that one company wrote for its own agent being distributed instantly across a broad ecosystem — competitors included. An asset like an emergency-response "how to fix it" playbook, the kind each vendor would normally wall off, has been spread sideways through the standard.

Where It Pays Off as a Business

With a critical vulnerability, the costly part of the initial response is, in truth, not the fix itself but the inventory of "where are affected versions running?" Combing by hand through Dockerfiles and CI configs scattered across tens or hundreds of repositories can burn half a day on its own. Mechanizing that step with a read-only scan, then dropping the fix into an approval-gated, per-PR flow, visibly lowers the load on the security on-call. Being free and open-source, and able to ride on agents that run within your existing subscription, means it can be tried without a new purchasing request — which lowers the barrier to adoption as well.

Behind the Convenience — "Don't Take the Agent's Fix at Face Value"

At the same time, Cognition itself attaches a number of caveats. Reading this one-sidedly as "you no longer need humans" is dangerous.

• It can only verify what the tests cover, and apps with thin test coverage are explicitly marked "high risk." The agent does not guarantee whether a hole still exists.
• For managed services and vendor appliances, it is designed not to rewrite anything in place but to report "confirm only / wait for the vendor's update." The premise that automated fixes aren't a cure-all is built in.
• Debian/Ubuntu-based systems patch via backports rather than bumping the version, so the caveat is that a simple version-number check can't be trusted.
• The heaviest warning concerns use outside Devin. Cognition states plainly: "Always review the Skill before running it. In most cases it runs locally, without Devin-level isolation, with the agent's full permissions." The risk of running someone else's playbook as-is with the highest privileges stays with the user.

The fixed versions are also pinned to the advisories as of October 21, so keeping up with newer fixes requires running npx skills update on a regular basis. The more convenient the automation, the more it depends on keeping humans able to trace who fixed what, and when.

References: Cognition / Devin Blog, "Vulnerability Fixes Plugin" / GitHub: CognitionAI/devin-vuln-fixes / MarkTechPost