CVE-2025-59359 OS command injection in Chaos Mesh via the cleanTcs mutation
Unauthenticated attackers can execute arbitrary OS commands in Chaos Mesh, leading to remote code execution across the cluster.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59359?
CVE-2025-59359 is a critical command injection vulnerability in chaos-mesh:chaos_mesh, published on 15 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Weakness: CWE-78
Which versions are affected by CVE-2025-59359?
3 open source packages ship an affected version, including github.com/chaos-mesh/chaos-mesh. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/chaos-mesh/chaos-mesh Go | All versions | None |
github.com/chaos-mesh/chaos-mesh Go | All versions | 2.7.3 |
github.com/chaos-mesh/chaos-mesh Go | All versions | 2.7.3 |
Products include Chaos-Mesh Chaos Mesh.
How do I fix CVE-2025-59359?
Upgrade github.com/chaos-mesh/chaos-mesh to 2.7.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-59359 being exploited?
There is no known exploitation of CVE-2025-59359 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in chaos-mesh:chaos_mesh
Sources
Also known as GHSA-369h-6j28-wwcg, GO-2025-3952.