CVE-2025-59360 | THREATINT

Description

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

PUBLISHED Reserved 2025-09-12 | Published 2025-09-15 | Updated 2025-09-15 | Assigner JFROG

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Any version

affected

References

github.com/chaos-mesh/chaos-mesh/pull/4702

jfrog.com/...-chaos-mesh-lead-to-kubernetes-cluster-takeover

cve.org (CVE-2025-59360)

nvd.nist.gov (CVE-2025-59360)

Download JSON