CVE-2025-59360

CRITICAL9.8EPSS 2.6%

Chaos Controller Manager is vulnerable to OS command injection

Published: 9/15/2025Modified: 9/17/2025

Also known as:GHSA-xv9f-728h-9jgvGO-2025-3954

Description

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

Affected packages (2)

Go/github.com/chaos-mesh/chaos-meshfrom 0, < 2.7.3
Go/github.com/chaos-mesh/chaos-meshfrom 0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (6)

ADVISORYhttps://github.com/advisories/GHSA-xv9f-728h-9jgv
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-59360
PATCHhttps://github.com/chaos-mesh/chaos-mesh
WEBhttps://github.com/chaos-mesh/chaos-mesh/commit/67281c36f8068bf103149318cd0a466417213a28
WEBhttps://github.com/chaos-mesh/chaos-mesh/pull/4702
WEBhttps://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover