GitHub Advisoryadvisory · Go

GHSA-2gcv-3qpf-c5qr Chaos Controller Manager is vulnerable to OS command injection

CRITICAL Published 2025-09-15 Modified 2025-09-15 Official page ↗
Aliases
CVE-2025-59361
Ecosystem
Go
Packages
github.com/chaos-mesh/chaos-mesh
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2025-09-15

Affected packages

• Go github.com/chaos-mesh/chaos-mesh: < 2.7.3 → fixed in 2.7.3

Description

The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

Related

Alias · CVE (1)

  • CVE-2025-59361 The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References