Chaos Controller Manager is vulnerable to OS command injection

CRITICO 9.8CVE-2025-59359 · GHSA-369h-6j28-wwcg · GO-2025-3952 · Published 15/09/2025 · updated 17/06/2026

In breve

CVE-2025-59359 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda github.com/chaos-mesh/chaos-mesh, chaos mesh (chaos-mesh).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.0%, superiore al 87.5% delle vulnerabilità.
Correzione: aggiornare a 2.7.3 o successiva.

Package	Affected versions	Patched versions
github.com/chaos-mesh/chaos-mesh Go	`< 2.7.3all versions`	`2.7.3`
chaos mesh chaos-mesh	`< 2.7.3`	`2.7.3`

Description

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-59359 · ADVISORY
chaos-mesh/chaos-mesh#4702 · WEB
chaos-mesh/chaos-mesh commit 67281c3 · WEB
chaos-mesh/chaos-mesh · PACKAGE
jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover · WEB
GitHub Advisory GHSA-369h-6j28-wwcg · ADVISORY

Altre vulnerabilità di github.com/chaos-mesh/chaos-mesh

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/chaos-mesh/chaos-mesh

< 2.7.3all versions

2.7.3

chaos mesh

chaos-mesh

< 2.7.3

2.7.3

Description

NVD description

Altre vulnerabilità di github.com/chaos-mesh/chaos-mesh

Vedi tutto →