CVE-2025-59360

CRITICAL9.8EPSS 2.6%

Chaos Controller Manager is vulnerable to OS command injection

發布日:2025/9/15修改日:2025/9/17

也稱為:GHSA-xv9f-728h-9jgvGO-2025-3954

描述

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

受影響套件(2)

Go/github.com/chaos-mesh/chaos-meshfrom 0, < 2.7.3
Go/github.com/chaos-mesh/chaos-meshfrom 0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(6)

ADVISORYhttps://github.com/advisories/GHSA-xv9f-728h-9jgv
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-59360
PATCHhttps://github.com/chaos-mesh/chaos-mesh
WEBhttps://github.com/chaos-mesh/chaos-mesh/commit/67281c36f8068bf103149318cd0a466417213a28
WEBhttps://github.com/chaos-mesh/chaos-mesh/pull/4702
WEBhttps://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover