What is GHSA-xfjj-f699-rc79?

GHSA-xfjj-f699-rc79 is a security advisory published by GitHub Security Advisories with Critical severity. tiagorlampert CHAOS vulnerable to arbitrary code execution

Which CVE IDs does GHSA-xfjj-f699-rc79 cover?

GHSA-xfjj-f699-rc79 covers the following CVE IDs: CVE-2024-33434. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xfjj-f699-rc79?

GHSA-xfjj-f699-rc79 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-xfjj-f699-rc79?

GHSA-xfjj-f699-rc79 affects 1 product, including: go/github.com/tiagorlampert/CHAOS:\u003c 0.0.0-20220716132853-b47438d36e3a.

GHSA-xfjj-f699-rc79CriticalCVSS 9.8

tiagorlampert CHAOS vulnerable to arbitrary code execution

Vendor

GitHub Security Advisories

Published

May 7, 2024

Last Modified

April 6, 2026

🔗 CVE IDs covered (1)

CVE-2024-33434 →

📋 Description

An issue in tiagorlampert CHAOS before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the filename argument into the buildStr string without any sanitization or filtering.

🎯 Affected products1

go/github.com/tiagorlampert/CHAOS:< 0.0.0-20220716132853-b47438d36e3a

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2024-33434
https://github.com/tiagorlampert/CHAOS/pull/95
https://gist.github.com/slimwang/d1ec6645ba9012a551ea436679244496
https://github.com/tiagorlampert/CHAOS/commit/1b451cf62582295b7225caf5a7b506f0bad56f6b
https://github.com/tiagorlampert/CHAOS/commit/24c9e109b5be34df7b2bce8368eae669c481ed5e
https://github.com/tiagorlampert/CHAOS/commit/b47438d36e3ad746de8c009e644f6e5396703f25
https://web.archive.org/web/20240406061035/https://blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents
https://github.com/advisories/GHSA-xfjj-f699-rc79