CVE-2026-91200

DevSpace through 6.3.21 fails to reject parent-directory (../) segments in tar entry names arriving over its in-pod file-sync stream, a CWE-22 path traversal flaw. When a developer uses DevSpace's sync or hot-reload against a container an attacker controls — for example a malicious or compromised third-party image — the attacker can craft tar entries that escape the intended sync directory and write arbitrary files on the developer's workstation. Because files can be placed anywhere on the local machine, this enables code execution with the developer's privileges. Anyone running DevSpace 6.3.21 or earlier who syncs with containers they do not fully control is affected. No public PoC is known, the issue is not on CISA's KEV list, and there is no evidence of exploitation in the wild.

What to do: Upgrade to a DevSpace release newer than 6.3.21 as soon as a fixed version is available. Until then, avoid using the in-pod sync/hot-reload feature with any image you did not build or fully trust, and consider running DevSpace inside an isolated VM or container to limit the blast radius of a traversal write. Review your workstation for unexpected files created outside sync directories if you have synced with third-party images recently.