Path Traversal Vulnerability in DevSpace In-Pod Sync

DevSpace versions 6.3.21 and earlier contain a security vulnerability, identified as CVE-2026-91200, related to how the application handles tar entries during the in-pod sync process. The software fails to properly sanitize or reject entries containing parent-directory segments (e.g., ../) within the tar stream received from a container. An attacker capable of operating a malicious or compromised container can exploit this oversight to perform directory traversal when syncing files to a developer's workstation. By crafting specific tar entries, an attacker can overwrite critical system files or place malicious executables in startup directories, potentially achieving remote code execution on the host machine. This poses a significant risk to development environments, as the synchronization utility operates with the privileges of the user running the DevSpace CLI.

Impact

Successful exploitation allows for unauthorized arbitrary file writes on a developer's local workstation. This can lead to full system compromise, exfiltration of sensitive source code or credentials present in the user environment, and the persistent installation of malicious software. The impact is significant given that the affected tool is typically used in trusted development environments where security controls might be relaxed compared to production infrastructure.

Recommendation

• Upgrade the DevSpace CLI to a version later than 6.3.21 immediately to address the vulnerability in the tar archive extraction logic.
• Audit developer workstations for unauthorized files created by the DevSpace binary within unexpected directories.
• Restrict container access to only authorized and trusted images to mitigate the risk of a malicious container interacting with the sync stream.