Chaos Controller Manager OS Command Injection Vulnerability Allowing Remote Code Execution
Vulnerability
A command injection vulnerability has been identified in the killProcesses mutation of Chaos Controller Manager. This issue, when combined with another vulnerability (CVE-2025-59358), enables unauthenticated attackers within the cluster to execute remote code across the entire Kubernetes cluster.
Impact
Exploitation of this vulnerability could lead to unauthorized code execution on all nodes within the Kubernetes cluster.
Remediation
Users are advised to update to the latest version of Chaos Mesh, where this vulnerability has been addressed.
Added: Sep 15, 2025, 12:18 PM
Updated: Sep 15, 2025, 10:00 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
4.9remediation
0.0relevance
0.5threat
0.1urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.