Editorial illustration for Cognition Releases Open-Source Agent to Patch Critical Node.js RCE Vulnerability
Cognition Releases Open-Source Agent for Node.js RCE Fix
Cognition shipped three open-source agent skills on GitHub this week, built to patch vulnerabilities the company's own Devin tool was already fixing internally. The package, called Devin Vulnerability Fixes, targets PHP2Shell, a Node.js security release dated October 21, 2026, and a self-managed GitLab bug carrying the maximum CVSS score of 10.0. All three skills carry an MIT license and run not just in Devin but in Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, OpenCode and Windsurf, provided the environment has git, a shell, Docker and registry access. Installing through npx requires Node.js 22.20 or newer.
The workflow Cognition packaged follows a fixed sequence: inventory affected systems, get approval, apply the patch, run tests, then open one pull request per repository. No published benchmark or fix-rate figure accompanies the release, so the plugin's real-world reliability depends on whatever test suite a team already has in place. Managed runtimes, appliances and Electron apps fall outside what the skills can actually patch, they get flagged instead.
Here's how Cognition describes the two PHP flaws driving the PHP2Shell advisory.
The Devin Vulnerability Fixes plugin is a set of three Agent Skills from Cognition. They find and patch vulnerable PHP, Node.js and self-managed GitLab deployments.
Why this matters
For engineering teams, this is less about Cognition's generosity and more about what it reveals: patching critical RCEs still takes too many manual steps across too many repos, and Node.js 20's end-of-life status means some shops are stuck exposed no matter what tooling they run. A skill that automates inventory, approval, patch, test, and PR creation is useful, but it's also a tell that the actual bottleneck in vulnerability response is coordination, not detection. We'd watch two things here.
First, whether SKILL.md becomes a real interoperability standard across coding agents, which would matter more long-term than this specific plugin. Second, who audits the patches these agents ship, since a CVSS 10.0 GitLab bug or a Brotli decoder bug in Node.js isn't something you want fixed by an agent with no human checking the diff. Founders building on Node or self-managed GitLab should treat this as a reminder to check their EOL exposure now, not as a reason to assume the problem's solved.
Related Reading
Open Source D&B rebuilds 642 million‑business database after AI agents hit limits
Open Source Box CEO Aaron Levie Says AI Will Drive "Biggest Cybersecurity Upgrade
Open Source Study: 6.7% of Deepfake Requests on Hugging Face Targeted Children
From Archives Anthropic Says Unreleased Model Outperforms Mythos 5.1 in Capability, Alignment
From Archives Cohere Releases Rerank 5, Scores 92.2 on ViDoRe V3 With Passage-Level Focus
Common Questions Answered
What are the three vulnerabilities targeted by Cognition's Devin Vulnerability Fixes agent skills?
The three vulnerabilities are PHP2Shell, a Node.js security release dated October 21, 2026, and a self-managed GitLab bug with a maximum CVSS score of 10.0. These agent skills are designed to find and automatically patch these critical vulnerabilities across different systems and deployments.
Which AI coding assistants and tools are compatible with the Devin Vulnerability Fixes plugin?
The Devin Vulnerability Fixes plugin runs across multiple platforms including Devin, Claude Code, Codex, Cursor, Factory Droid, GitHub Copilot, Gemini CLI, and OpenCode. This broad compatibility ensures that engineering teams using different AI coding assistants can access the vulnerability patching capabilities.
What license does Cognition use for the Devin Vulnerability Fixes open-source agent skills?
All three agent skills in the Devin Vulnerability Fixes package carry an MIT license, making them freely available and modifiable for developers. This permissive licensing approach allows teams to integrate and customize the vulnerability patching tools for their specific needs.
Why is the automation of vulnerability patching important beyond just detecting vulnerabilities?
According to the article, the real bottleneck in vulnerability response is coordination rather than detection, as patching critical RCEs still requires too many manual steps across multiple repositories. Automating inventory, approval, patch, test, and PR creation helps teams respond faster to vulnerabilities, especially when dealing with end-of-life software like Node.js 20 that leaves systems exposed.
Further Reading
- Fixing Critical Node & PHP Flaws - Devin
- Cognition open-sources Vulnerability Fixes plugin for PHP, Node.js and self-managed GitLab - Digg
- GitHub - CognitionAI/devin-vuln-fixes: Skills to help detect and remediate known CVEs and vulnerabilities - GitHub
- Introducing Devin Security Swarm - Cognition
- Security at Cognition - Devin Documentation
