CVE-2026-91200

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.

  • Published Sep 14, 2026
  • CVSS 8.7 high
  • 0.7% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-91200 at the National Vulnerability Database