CVE-2025-59360 — OS command injection in Chaos Mesh via the killProcesses mutation
The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attacker…
Published: 2025-09-15 · CVSS: 9.8 · CVSS 3.1
The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7