CVE-2025-59360

critical · 9.8

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

9.8

CVSS

2.8%

EPSS (exploit prob.)

86th

EPSS percentile

2025-09-15

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
chaos-mesh	chaos_mesh	< 2.7.3

Check a specific version with /api/v1/cve/match.

References

https://github.com/chaos-mesh/chaos-mesh/pull/4702
https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-59360