CVE-2026-72573 in pm2panel
Summary
by MITRE • 08/10/2026
An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified in 4xmen/pm2panel represents a critical operating system command injection flaw that compromises the integrity and confidentiality of affected systems. This issue exists within the pm2panel.js file at line 188 where the application fails to properly sanitize user input before incorporating it into system commands. The specific implementation passes the unsanitized req.query.id parameter directly to the exec() function without any form of input validation or shell escaping mechanisms, creating an exploitable pathway for malicious actors.
The technical nature of this vulnerability aligns with CWE-78, which defines improper neutralization of special elements used in OS commands. The flaw operates by allowing an authenticated remote attacker to manipulate the id parameter through query string inputs, enabling them to inject arbitrary shell commands. When an attacker submits a malicious payload such as 'id=1; whoami', the application concatenates this input directly into the command string, resulting in unintended system behavior where multiple commands can be executed sequentially through shell metacharacters like semicolons. This injection mechanism extends beyond simple command execution to enable full system compromise through command chaining and arbitrary code execution.
From an operational perspective, this vulnerability poses significant risks to organizations relying on pm2panel for process management and monitoring. The authenticated nature of the attack means that even limited user access can be escalated to complete system control, potentially allowing attackers to exfiltrate sensitive data, install backdoors, or disrupt critical services. The impact extends beyond immediate command execution to include potential privilege escalation opportunities and lateral movement within networks where pm2panel is deployed. Security professionals should consider this vulnerability as part of the broader ATT&CK framework under T1059.001 for Command and Scripting Interpreter, with potential implications for privilege escalation techniques.
Mitigation strategies must address both immediate remediation and long-term architectural improvements to prevent similar vulnerabilities from occurring. The primary solution involves implementing proper input validation and sanitization mechanisms that ensure user-supplied parameters cannot be interpreted as shell commands. This includes employing parameterized command execution, utilizing safe string escaping functions, or implementing dedicated input filtering libraries specifically designed for shell command contexts. Organizations should also consider implementing principle of least privilege access controls to limit the impact of successful exploitation attempts. Additionally, regular security audits and automated vulnerability scanning should be integrated into deployment pipelines to identify and remediate similar injection vulnerabilities across the application stack. The implementation of web application firewalls and input validation layers can provide additional defense-in-depth measures to protect against such attacks while ensuring proper code review processes are established to prevent future occurrences of this class of vulnerability.