tiagorlampert CHAOS vulnerable to Cross Site Scripting

MEDIUM 4.8CVE-2024-31839 · GHSA-c5rv-hjjc-jv7m · GO-2024-2721 · Published 12/04/2024 · updated 17/06/2026

In short

CVE-2024-31839 is a MEDIUM (CVSS 4.8) vulnerability affecting github.com/tiagorlampert/CHAOS, chaos (tiagorlampert).
Chance of exploitation in the next 30 days (EPSS): 8.1%, higher than 94.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
github.com/tiagorlampert/CHAOS Go	`≤ 5.0.1all versions`	No fix yet
chaos tiagorlampert	`= 5.0.1`	No fix yet

Description

Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component.

NVD description

Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component.

References

nvd.nist.gov/vuln/detail/CVE-2024-31839 · ADVISORY
blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents · WEB
tiagorlampert/CHAOS · PACKAGE
blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free