EUVD-2026-78209

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

CVE-2026-91200

DevSpace versions through 6.3.21 contain a path traversal vulnerability in the in-pod sync stream's tar extraction logic. The tool fails to reject parent-directory segments in tar entry names, allowing an attacker operating a malicious container to stream tar entries with traversal sequences that...