CVE-2025-59359

OS command injection in Chaos Mesh via the cleanTcs mutation

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

Affected

github.com/chaos-mesh/chaos-mesh

CVSS v3.1 JFROG

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.93% chance of exploitation in the next 30 days, 87th percentile

Published

2025-09-15

Proof-of-concept exploits (1)

• mrk336/Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover0★ · 2025-09-18

Security advisories

• https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kube…
• advisories/GHSA-369h-6j28-wwcg
• chaos-mesh/chaos-mesh/pull/4702

References

• CVE Record
• NVD entry

Related

• CVE-2021-3456
• CVE-2024-10220
• CVE-2024-3094
• CVE-2025-23266
• CVE-2025-26686
• CVE-2025-27480