https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T17:32:35.226855+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-319106 EUVD-2026-319106 2026-10-12T17:32:35.277962+00:00 EUVD-2026-319106 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42283 fkie_cve-2026-42283 2026-10-12T17:32:35.277997+00:00

DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090. This vulnerability is fixed in 6.3.21.

 https://cve.radiocsirt.org/vuln/ghsa-hqwm-7x7x-8379 GHSA-hqwm-7x7x-8379 — DevSpace UI Server WebSocket CheckOrigin does not validate source 2026-10-12T17:32:35.278032+00:00

Affected: Go: github.com/loft-sh/devspace

### Description

DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to `ws://127.0.0.1:8090`. This allows an attacker to access: * `/api/logs` to stream real-time pod logs * `/api/enter` to open an interactive shell inside the running pod * `/api/command` to execute pre-defined pipeline commands

### Patches

Versions 6.3.21 and above are patched.

### Resources

[gorilla/websocket CheckOrigin documentation](https://pkg.go.dev/github.com/gorilla/websocket#hdr-Origin_Considerations)

### Installation Options

Devspace is no longer publishing to NPM or Yarn, please continue to use our [other installation methods](https://www.devspace.sh/docs/getting-started/installation) to get updates in the future, including this patch.

### Credit

DevSpace thanks @b0b0haha for finding and reporting this vulnerability.