CVE-2026-72573

Name of the Vulnerable Software and Affected Versions 4xmen/pm2panel (affected versions not specified)

Description An OS command injection flaw allows an authenticated remote attacker to execute arbitrary system commands on the host. The issue occurs in the pm2panel.js handler where the id parameter from the req.query object is passed directly to the exec() function without proper input validation or shell escaping. This allows an attacker to use shell metacharacters, such as semicolons, to chain and execute unauthorized commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.