What is the CVSS score of CVE-2025-59360?

CVE-2025-59360 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Which versions of Chaos Mesh are affected by CVE-2025-59360?

Organizations using killProcesses mutation in Chaos Controller Manager face critical risk from CVE-2025-59360, a OS command injection vulnerability rated CVSS 9.8.. A patch is available.

Is there a public PoC exploit available for CVE-2025-59360?

Yes, a public proof-of-concept exploit is available for CVE-2025-59360. Prioritise patching immediately. EPSS: 1.1%.

How to fix or mitigate CVE-2025-59360?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Chaos Mesh CVE-2025-59360

CRITICAL

OS Command Injection (CWE-78)

2025-09-15 reefs@jfrog.com

RCE Command Injection Suse Chaos Mesh

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:12 vuln.today

Patch released

Mar 28, 2026 - 19:12 nvd

Patch available

PoC Detected

Oct 14, 2025 - 14:43 vuln.today

Public exploit code

CVE Published

Sep 15, 2025 - 12:15 nvd

CRITICAL 9.8

DescriptionCVE.org

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

AnalysisAI

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster. Affected products include: Chaos-Mesh Chaos Mesh.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.

More in Chaos Mesh

View all

CVE-2025-59359 CRITICAL Act Now POC

9.8 Sep 15

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. Rated critical severity (CVSS 9

CVE-2025-59361 CRITICAL Act Now POC

9.8 Sep 15

The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. Rated critical severity (C

CVE-2024-36538 HIGH This Week POC

8.8 Jul 24

Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining

CVE-2025-59358 HIGH This Week POC

7.5 Sep 15

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kuber

Same weakness CWE-78 – OS Command Injection

View all

CVE-2019-15107 CRITICAL POC

9.8

CVE-2024-51378 CRITICAL POC

9.8

CVE-2014-6271 CRITICAL POC

9.8

CVE-2018-11138 CRITICAL POC

9.8

CVE-2014-6278 HIGH POC

8.8

CVE-2017-6334 HIGH POC

8.8

CVE-2024-50603 CRITICAL POC

10.0

CVE-2024-9474 MEDIUM POC

6.9

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE	Affected
openSUSE Tumbleweed	Fixed

Product

Status

Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE

Affected

openSUSE Tumbleweed

Fixed

CVE-2025-59360 vulnerability details – vuln.today

Back

Chaos Mesh CVE-2025-59360

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Chaos Mesh

Same weakness CWE-78 – OS Command Injection

Same technique RCE

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code