CVE-2025-59360

PoC —

CVSS 3.1

9.8 critical

EPSS

3%p86

Published

Sep 15, 2025 (Sep 15, 2025)

Modified

Jun 17, 2026

Description

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

Vendors: chaos-mesh
Products: chaos mesh
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.8%)

In the news2 stories

Critical CVEs in Chaos-Mesh Enable In

Infosecurity MagazineSep 17, 16:00 UTC · Sep 17, 2025Vulnerability CVE-2025-59358 CVE-2025-59360 CVE-2025-59361+1 CVEs

Chaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover

The Hacker NewsSep 17, 06:14 UTC · Sep 17, 2025Vulnerability CVE-2025-59358 CVE-2025-59359 CVE-2025-59360+1 CVEs