OS Command Injection in pm2panel by 4xmen

CVE-2026-72573

What is CVE-2026-72573?

An OS command injection vulnerability exists in the pm2panel product by 4xmen, which allows authenticated remote attackers to execute arbitrary commands on the host system. The vulnerability arises from the pm2panel.js file, where the unsanitized user input from the req.query.id parameter is directly used in the command execution function. This flaw does not incorporate proper input validation or shell escaping, allowing attackers to exploit the vulnerability through command chaining using semicolons or other shell metacharacters. As a result, attackers holding authenticated access can manipulate the host environment, leading to potential security breaches.

References