CVE-2025-59361 OS command injection in Chaos Mesh via the cleanIptables mutation
Unauthenticated attackers can execute arbitrary OS commands in Chaos Mesh, leading to remote code execution across the cluster.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59361?
CVE-2025-59361 is a critical command injection vulnerability in chaos-mesh:chaos_mesh, published on 15 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
Weakness: CWE-78
Which versions are affected by CVE-2025-59361?
3 open source packages ship an affected version, including github.com/chaos-mesh/chaos-mesh. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/chaos-mesh/chaos-mesh Go | All versions | None |
github.com/chaos-mesh/chaos-mesh Go | All versions | 2.7.3 |
github.com/chaos-mesh/chaos-mesh Go | All versions | 2.7.3 |
Products include Chaos-Mesh Chaos Mesh.
How do I fix CVE-2025-59361?
Upgrade github.com/chaos-mesh/chaos-mesh to 2.7.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-59361 being exploited?
There is no known exploitation of CVE-2025-59361 in the wild and no public exploit code.
Other vulnerabilities in chaos-mesh:chaos_mesh
Sources
Also known as GHSA-2gcv-3qpf-c5qr, GO-2025-3949.