https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 12:54:05 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-319106 EUVD-2026-319106 https://cve.radiocsirt.org/vuln/euvd-2026-319106 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42283 <p>DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace&#39;s UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090. This vulnerability is fixed in 6.3.21.</p> <p>DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace&#39;s UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090. This vulnerability is fixed in 6.3.21.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42283 https://cve.radiocsirt.org/vuln/ghsa-hqwm-7x7x-8379 <p><strong>Affected:</strong> Go: github.com/loft-sh/devspace</p> <p>### Description</p> <p>DevSpace&#39;s UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to `ws://127.0.0.1:8090`. This allows an attacker to access: * `/api/logs` to stream real-time pod logs * `/api/enter` to open an interactive shell inside the running pod * `/api/command` to execute pre-defined pipeline commands</p> <p>### Patches</p> <p>Versions 6.3.21 and above are patched.</p> <p>### Resources</p> <p>[gorilla/websocket CheckOrigin documentation](https://pkg.go.dev/github.com/gorilla/websocket#hdr-Origin_Considerations)</p> <p>### Installation Options</p> <p>Devspace is no longer publishing to NPM or Yarn, please continue to use our [other installation methods](https://www.devspace.sh/docs/getting-started/installation) to get updates in the future, including this patch.</p> <p>### Credit</p> <p>DevSpace thanks @b0b0haha for finding and reporting this vulnerability.</p> <p><strong>Affected:</strong> Go: github.com/loft-sh/devspace</p> <p>### Description</p> <p>DevSpace&#39;s UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to `ws://127.0.0.1:8090`. This allows an attacker to access: * `/api/logs` to stream real-time pod logs * `/api/enter` to open an interactive shell inside the running pod * `/api/command` to execute pre-defined pipeline commands</p> <p>### Patches</p> <p>Versions 6.3.21 and above are patched.</p> <p>### Resources</p> <p>[gorilla/websocket CheckOrigin documentation](https://pkg.go.dev/github.com/gorilla/websocket#hdr-Origin_Considerations)</p> <p>### Installation Options</p> <p>Devspace is no longer publishing to NPM or Yarn, please continue to use our [other installation methods](https://www.devspace.sh/docs/getting-started/installation) to get updates in the future, including this patch.</p> <p>### Credit</p> <p>DevSpace thanks @b0b0haha for finding and reporting this vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-hqwm-7x7x-8379