EUVD-2026-30319
GHSA-hqwm-7x7x-8379
Severity by source
AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Description
DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090. This allows an attacker to access:
/api/logsto stream real-time pod logs/api/enterto open an interactive shell inside the running pod/api/commandto execute pre-defined pipeline commands
Patches
Versions 6.3.21 and above are patched.
Resources
gorilla/websocket CheckOrigin documentation
Installation Options
Devspace is no longer publishing to NPM or Yarn, please continue to use our other installation methods to get updates in the future, including this patch.
Credit
DevSpace thanks @b0b0haha for finding and reporting this vulnerability.
AnalysisAI
Cross-Site WebSocket Hijacking in DevSpace UI Server allows remote attackers to execute commands inside Kubernetes pods when developers visit malicious websites while DevSpace UI is running. The UI server's WebSocket endpoint at localhost:8090 accepts connections from any origin, enabling browser-based exploitation without authentication. DevSpace 6.3.20 and earlier are affected; version 6.3.21 contains the fix. No public exploit code identified at time of analysis, but exploitation technique is well-documented in WebSocket security research. The vulnerability enables attackers to stream pod logs, open interactive shells, and execute pipeline commands through the victim's active DevSpace session.
Technical ContextAI
DevSpace is a Kubernetes development tool written in Go that provides a local UI server for managing development environments. The vulnerability stems from improper implementation of the gorilla/websocket library's CheckOrigin function, which by default returns true for all origins. The WebSocket server listens on localhost:8090 and exposes three critical API endpoints (/api/logs, /api/enter, /api/command) without origin validation. This is a Cross-Site WebSocket Hijacking (CSWSH) attack vector, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Modern browsers allow JavaScript on any webpage to initiate WebSocket connections to localhost, and without CheckOrigin validation, the server cannot distinguish legitimate UI connections from attacker-controlled cross-origin requests. The affected package is pkg:go/github.com/loft-sh/devspace, and the fix in version 6.3.21 implements proper origin checking per gorilla/websocket security guidelines.
RemediationAI
Upgrade to DevSpace 6.3.21 or later, which implements proper WebSocket origin validation per the gorilla/websocket CheckOrigin security model. The patch is available through standard DevSpace installation methods documented at https://www.devspace.sh/docs/getting-started/installation - do NOT use deprecated NPM/Yarn packages. If immediate upgrade is not feasible, implement the following compensating controls: (1) Only run DevSpace UI when actively needed, then terminate the process - this minimizes the attack window to seconds rather than hours. (2) Use browser profiles or separate browsers for development work versus general web browsing, ensuring the browser running DevSpace UI never navigates to untrusted sites. (3) Deploy network-level controls to block outbound WebSocket connections from web browsers to localhost:8090, though this may interfere with legitimate UI functionality. (4) Consider firewall rules restricting which processes can bind to port 8090, though this is complex to implement correctly. Note that disabling the UI server entirely eliminates the attack surface but removes DevSpace's visual management capabilities. The primary fix (upgrade to 6.3.21) has no known side effects and is the recommended remediation.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today