CVE-2025-59360 OS command injection in Chaos Mesh via the killProcesses mutation
Unauthenticated attackers can execute arbitrary OS commands via the killProcesses mutation, leading to remote code execution across the cluster.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59360?
CVE-2025-59360 is a critical command injection vulnerability in chaos-mesh:chaos_mesh, published on 15 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Weakness: CWE-78
Which versions are affected by CVE-2025-59360?
3 open source packages ship an affected version, including github.com/chaos-mesh/chaos-mesh. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/chaos-mesh/chaos-mesh Go | All versions | None |
github.com/chaos-mesh/chaos-mesh Go | All versions | 2.7.3 |
github.com/chaos-mesh/chaos-mesh Go | All versions | 2.7.3 |
Products include Chaos-Mesh Chaos Mesh.
How do I fix CVE-2025-59360?
Upgrade github.com/chaos-mesh/chaos-mesh to 2.7.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-59360 being exploited?
There is no known exploitation of CVE-2025-59360 in the wild and no public exploit code.
Other vulnerabilities in chaos-mesh:chaos_mesh
Sources
Also known as GHSA-xv9f-728h-9jgv, GO-2025-3954.