What is GHSA-369h-6j28-wwcg?

GHSA-369h-6j28-wwcg is a security advisory published by GitHub Security Advisories with Critical severity. Chaos Controller Manager is vulnerable to OS command injection

Which CVE IDs does GHSA-369h-6j28-wwcg cover?

GHSA-369h-6j28-wwcg covers the following CVE IDs: CVE-2025-59359. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-369h-6j28-wwcg?

GHSA-369h-6j28-wwcg has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-369h-6j28-wwcg?

GHSA-369h-6j28-wwcg affects 1 product, including: go/github.com/chaos-mesh/chaos-mesh:\u003c 2.7.3.

GHSA-369h-6j28-wwcgCriticalCVSS 9.8

Chaos Controller Manager is vulnerable to OS command injection

Vendor

GitHub Security Advisories

Published

September 15, 2025

Last Modified

September 15, 2025

🔗 CVE IDs covered (1)

CVE-2025-59359 →

📋 Description

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

🎯 Affected products1

go/github.com/chaos-mesh/chaos-mesh:< 2.7.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-59359
https://github.com/chaos-mesh/chaos-mesh/pull/4702
https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover
https://github.com/chaos-mesh/chaos-mesh/commit/67281c36f8068bf103149318cd0a466417213a28
https://github.com/advisories/GHSA-369h-6j28-wwcg