What is GHSA-xv9f-728h-9jgv?

GHSA-xv9f-728h-9jgv is a security advisory published by GitHub Security Advisories with Critical severity. Chaos Controller Manager is vulnerable to OS command injection

Which CVE IDs does GHSA-xv9f-728h-9jgv cover?

GHSA-xv9f-728h-9jgv covers the following CVE IDs: CVE-2025-59360. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xv9f-728h-9jgv?

GHSA-xv9f-728h-9jgv has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-xv9f-728h-9jgv?

GHSA-xv9f-728h-9jgv affects 1 product, including: go/github.com/chaos-mesh/chaos-mesh:\u003c 2.7.3.

GHSA-xv9f-728h-9jgvCriticalCVSS 9.8

Chaos Controller Manager is vulnerable to OS command injection

Vendor

GitHub Security Advisories

Published

September 15, 2025

Last Modified

September 15, 2025

🔗 CVE IDs covered (1)

CVE-2025-59360 →

📋 Description

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

🎯 Affected products1

go/github.com/chaos-mesh/chaos-mesh:< 2.7.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-59360
https://github.com/chaos-mesh/chaos-mesh/pull/4702
https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover
https://github.com/chaos-mesh/chaos-mesh/commit/67281c36f8068bf103149318cd0a466417213a28
https://github.com/advisories/GHSA-xv9f-728h-9jgv