| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/loft-sh/devspace | < 4.14.0 | 4.14.0 |
| devspace | = 4.13.0 |
The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free