[CVE-2026-91200] DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod…

Descripción técnica

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.

Puntuación CVSS

Score: 8.8/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Debilidades (CWE)

CWE-22

Fuente oficial

Publicado en NIST NVD.