github.com/chaos-mesh/chaos-mesh (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/chaos-mesh/chaos-mesh, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2025-59359 — CVSS 9.8 (critical): The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows…
• CVE-2025-59360 — CVSS 9.8 (critical): The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this…
• CVE-2025-59361 — CVSS 9.8 (critical): The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this…
• CVE-2025-59358 — CVSS 7.5 (high): The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster…