{"id":"CVE-2026-42283","aliases":["GHSA-hqwm-7x7x-8379","GO-2026-5433"],"url":"https://o3.security/vulnerability/CVE-2026-42283","summary":"DevSpace UI Server WebSocket CheckOrigin does not validate source","details":"### Description\n\nDevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to `ws://127.0.0.1:8090`. This allows an attacker to access: \n* `/api/logs` to stream real-time pod logs\n* `/api/enter` to open an interactive shell inside the running pod\n* `/api/command` to execute pre-defined pipeline commands\n\n### Patches\n\nVersions 6.3.21 and above are patched.\n\n### Resources\n\n[gorilla/websocket CheckOrigin documentation](https://pkg.go.dev/github.com/gorilla/websocket#hdr-Origin_Considerations)\n\n### Installation Options\n\nDevspace is no longer publishing to NPM or Yarn, please continue to use our [other installation methods](https://www.devspace.sh/docs/getting-started/installation) to get updates in the future, including this patch.\n\n### Credit\n\nDevSpace thanks @b0b0haha for finding and reporting this vulnerability.","published":"2026-05-14T15:44:22.499Z","modified":"2026-08-12T03:51:38.555813424Z","cvss":{"score":7.7,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"},"epss":{"score":0.00152,"percentile":0.04889,"asOf":"2026-08-13"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/loft-sh/devspace","fixedVersion":"6.3.21"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42283.json"},{"type":"ADVISORY","url":"https://github.com/devspace-sh/devspace/security/advisories/GHSA-hqwm-7x7x-8379"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42283"},{"type":"PACKAGE","url":"https://github.com/devspace-sh/devspace"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:38.555813424Z"}}