Devspace

devspace

2 CVEs • 1 product

Products (1)

Click to collapse

Toggle

Devspace

devspace

2 CVEs

CVEs (2)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-42283 1Devspace 1Devspace Jun 17, 2026 May 14, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are...Show more DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090. This vulnerability is fixed in 6.3.21.Show less
CVE-2020-15391 1Devspace 1Devspace Jun 17, 2026 Jul 23, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2026-42283

1Devspace

Jun 17, 2026

May 14, 2026

N/A· v4

7.8 HIGH· v3

N/A· v2

DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090. This vulnerability is fixed in 6.3.21.Show less

CVE-2020-15391

1Devspace

Jun 17, 2026

Jul 23, 2020

N/A· v4

9.8 CRITICAL· v3

7.5 HIGH· v2

The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.