devspace-sh vulnerabilities and threats

DevSpace versions prior to 6.3.21 have a vulnerability where the UI server WebSocket accepts connections from all origins by default. This allows a malicious website visited by a developer to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090, exposing several endpoints without proper authentication. The issue is fixed in version 6.3.21.