CVE-2026-91200 devspace CVE debrief

Who should care

Developers and administrators using DevSpace to sync files between their workstation and Kubernetes pods should assess their exposure and update to a fixed version. Additionally, security teams and vulnerability management teams should review the vulnerability and assess the risk to their organization. Operators of Kubernetes pods and platforms that use DevSpace for file synchronization should also be aware of the vulnerability and take steps to mitigate,

Why it matters

CVE-2026-91200 is a high-severity vulnerability in DevSpace that allows an attacker to write arbitrary files on a developer's workstation, potentially leading to code execution. Developers and administrators using DevSpace should assess their exposure and update to a fixed version.

• Code execution on developer workstations
• Arbitrary file writes on developer workstations
• Potential for lateral movement within the network

Technical summary

The vulnerability exists in the tar sync functionality of DevSpace, allowing an attacker to stream tar entries with traversal sequences to write arbitrary files on the developer workstation. This is possible due to inadequate validation of tar entry names, which enables an attacker to bypass security measures and write files outside the intended directory. The vulnerability can be exploited by an attacker operating a malicious container, potentially leading to code execution on the workstation. The vulnerability has a high CVSS score, indicating a significant risk to affected systems.

Defensive priority

High

Recommended defensive actions

• Review and update DevSpace to version 6.3.22 or later
• Restrict access to the Kubernetes pod to prevent malicious containers from being deployed
• Monitor file system changes on developer workstations for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and references to source code and issue discussions. The vulnerability was reported by a researcher and patched by the vendor. The CVE record provides additional context and references to the vendor's advisory and other sources that discuss the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.