CVE-2026-72573

An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/4xmen/pm2panel
https://github.com/4xmen/pm2panel/blob/main/pm2panel.js

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección de comandos del sistema operativo en 4xmen/pm2panel (todas las versiones) permite a un atacante remoto autenticado ejecutar comandos de sistema arbitrarios en el host. El gestor pm2panel.js en la línea 188 pasa el parámetro req.query.id sin sanear directamente a exec(’pm2 restart ’ + id) sin validación de entrada ni escape de shell, lo que permite el encadenamiento de comandos a través de puntos y coma u otros metacaracteres de shell.

Information

Published : 2026-08-10 11:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72573

Mitre link : CVE-2026-72573

CVE.ORG link : CVE-2026-72573

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-72573", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72573", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-10T15:53:33.773598Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "4xmen", "product": "pm2panel", "versions": [{"status": "affected", "version": "0", "versionType": "semver"}], "defaultStatus": "unknown"}]}], "published": "2026-08-10T11:17:30.010", "references": [{"url": "https://github.com/4xmen/pm2panel", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/4xmen/pm2panel/blob/main/pm2panel.js", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en 4xmen/pm2panel (todas las versiones) permite a un atacante remoto autenticado ejecutar comandos de sistema arbitrarios en el host. El gestor pm2panel.js en la l\u00ednea 188 pasa el par\u00e1metro req.query.id sin sanear directamente a exec(\u2019pm2 restart \u2019 + id) sin validaci\u00f3n de entrada ni escape de shell, lo que permite el encadenamiento de comandos a trav\u00e9s de puntos y coma u otros metacaracteres de shell."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}