Threats affecting pkg:github/devspace-sh/devspace

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.

DevSpace versions prior to 6.3.21 have a vulnerability where the UI server WebSocket accepts connections from all origins by default. This allows a malicious website visited by a developer to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090, exposing several endpoints without proper authentication. The issue is fixed in version 6.3.21.