CVE-2025-59359

CriticalPublic PoCRCE

Published: 15 September 2025

Published

15 September 2025

Modified

14 October 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0152 81.4th percentile

Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-59359 is a critical-severity OS Command Injection (CWE-78) vulnerability in Chaos-Mesh Chaos Mesh. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 18.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Unix Shell (T1059.004) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mandates timely patching of the OS command injection flaw in Chaos Controller Manager as detailed in the Chaos Mesh pull request to prevent remote code execution.

SI-10 Information Input Validation good match

prevent

Requires validation of inputs to the cleanTcs mutation to block malicious OS command injection payloads from unauthenticated in-cluster attackers.

RA-5 Vulnerability Monitoring and Scanning good match

prevent

Ensures vulnerability scanning identifies CVE-2025-59359 in Chaos Mesh deployments for prompt remediation before exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

Why these techniques?

CVE-2025-59359 enables OS command injection (T1059.004: Unix Shell) in the Chaos Controller Manager via the cleanTcs GraphQL mutation, facilitating exploitation of the remote service (T1210) for unauthenticated in-cluster remote code execution on arbitrary pods.

NVD Description

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.

Deeper analysisAI

CVE-2025-59359 is an OS command injection vulnerability (CWE-78) in the cleanTcs mutation of the Chaos Controller Manager within Chaos Mesh. Published on 2025-09-15, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for high-impact exploitation over the network with low complexity and no privileges required.

Unauthenticated in-cluster attackers can exploit this vulnerability in conjunction with CVE-2025-59358 to achieve remote code execution across the Kubernetes cluster, enabling full compromise of cluster resources.

Mitigation details are available in Chaos Mesh's patch via pull request https://github.com/chaos-mesh/chaos-mesh/pull/4702 and the JFrog advisory at https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover, which discusses the vulnerabilities leading to cluster takeover.