Executive brief
DevSpace is a developer tool used to streamline container deployments and development workflows in Kubernetes environments. A flaw in how it processes file synchronization streams allows attackers with access to a container to write arbitrary files to the developer's workstation by using specially crafted tar entries with directory traversal sequences, potentially enabling code execution.
Technical details
The vulnerability is a path traversal flaw in DevSpace's tar stream parser (pkg/devspace/sync/tar.go) that fails to sanitize parent-directory segments (e.g., "../") in tar entry names during in-pod file synchronization. An attacker operating a malicious container can craft tar entries containing traversal sequences to write files outside the intended sync directory on the developer's machine. The attack requires the developer to be actively syncing files with the malicious container, but no special authentication is needed from the container's perspective. An attacker can achieve arbitrary file write and code execution on the developer workstation. Patches are expected in versions after 6.3.21.
Affected products
- DevSpace DevSpace through 6.3.21
Timeline
- 2026-09-14: disclosed