CVE-2026-42283

HighCVSS 7.8/10Last modified Nov 11, 2026

Description

DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090. This vulnerability is fixed in 6.3.21.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200 CWE-306

Affected software

Vendor	Product	Versions
devspace-sh	devspace	< 6.3.21

References

https://github.com/devspace-sh/devspace/security/advisories/GHSA-hqwm-7x7x-8379Vendor Advisory

Timeline

Published: May 14, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-422849.8GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the origi CVE-2026-422857.5GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated re CVE-2026-422868.4Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attacke CVE-2026-4228710.0Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allo CVE-2026-4228810.0ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-authentication remot CVE-2026-422898.8ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates CVE-2026-42297.3A flaw has been found in vanna-ai vanna up to 2.0.2. This impacts the function remove_training_data of the file src/vanna/legacy/google/bigq CVE-2026-422907.8protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string f CVE-2026-422916.8SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoints for reading and c CVE-2026-422947.5Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 an CVE-2026-422954.9Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to befor CVE-2026-422968.1Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 an