DevSpace UI server WebSocket accepts connections from all origins by default, exposing several endpoints through this WebSocket. This flaw can be triggered when a developer runs the DevSpace UI and visits a malicious website, which can then initiate a WebSocket connection to ws://127.0.0.1:8090 and potentially read data from the UI. The impact follows CWE‑200 and CWE‑306, indicating that sensitive information may be exposed and the origin cannot be verified, raising the risk of unauthorized data access.

The vulnerability affects DevSpace, a client‑only developer tool for cloud‑native development with Kubernetes, before version 6.3.21. All users running older versions of the DevSpace UI server are susceptible.

The CVSS score of 7.7 reflects a high‑severity weakness. Because the exploit requires only a malicious web page and an active DevSpace UI session, the attack probability is high for exposed developers, although EPSS data is not available and the issue is not present in the CISA KEV catalog. The likely attack vector is a browser‑based malicious website that opens a cross‑origin WebSocket connection, and it does not require any special privileges beyond user interaction.