Skip to content
OpenAdvisories

Package · Go

github.com/chaos-mesh/chaos-mesh

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Critical 9.8
    CVE-2025-59361

    OS command injection in Chaos Mesh via the cleanIptables mutation

    The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

    github.com/chaos-mesh/chaos-mesh Go
  • Critical 9.8
    CVE-2025-59360

    OS command injection in Chaos Mesh via the killProcesses mutation

    The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

    github.com/chaos-mesh/chaos-mesh Go
  • Critical 9.8
    CVE-2025-59359 Public exploit

    OS command injection in Chaos Mesh via the cleanTcs mutation

    The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

    github.com/chaos-mesh/chaos-mesh Go
  • High 7.5
    CVE-2025-59358

    Denial of Service via Unauthorized Access to Chaos Mesh debugging server

    The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.

    github.com/chaos-mesh/chaos-mesh Go