CVE-2026-72573 - Vulnerability Details - OpenCVE

An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://github.com/4xmen/pm2panel
https://github.com/4xmen/pm2panel/blob/main/pm2panel.js

History

Mon, 10 Aug 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 10 Aug 2026 11:00:00 +0000

Type	Values Removed	Values Added
Description		An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.
Title		4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter
Weaknesses		CWE-78
References		https://github.com/4xmen/pm2panel https://github.com/4xmen/pm2panel/blob/main/pm2panel.js
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: TuranSec

Published: 2026-08-10T10:40:54.998Z

Updated: 2026-08-10T18:22:59.699Z

Reserved: 2026-08-10T10:32:53.853Z

Link: CVE-2026-72573

Vulnrichment

Updated: 2026-08-10T15:56:17.684Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-10T13:00:04Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72573", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-10T10:32:53.853Z", "datePublished": "2026-08-10T10:40:54.998Z", "dateUpdated": "2026-08-10T18:22:59.699Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T10:56:39.956Z"}, "title": "4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter", "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.</p>"}]}], "affected": [{"vendor": "4xmen", "product": "pm2panel", "versions": [{"version": "0", "status": "affected", "versionType": "semver"}], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/4xmen/pm2panel", "name": "Product", "tags": ["third-party-advisory"]}, {"url": "https://github.com/4xmen/pm2panel/blob/main/pm2panel.js", "name": "Vulnerable File", "tags": ["technical-description"]}], "credits": [{"lang": "en", "value": "Bo'riboy Abdurahmonov", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "timeline": [{"time": "2026-08-10T10:32:53.000Z", "lang": "en", "value": "CVE Reserved"}, {"time": "2026-08-10T10:32:53.000Z", "lang": "en", "value": "Public Disclosure"}], "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-10T10:32:53.000Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T15:53:33.773598Z", "id": "CVE-2026-72573", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T18:22:59.699Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72573", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-10T15:53:33.773598Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T15:56:17.684Z"}}], "cna": {"title": "4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Bo'riboy Abdurahmonov"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "4xmen", "product": "pm2panel", "versions": [{"status": "affected", "version": "0", "versionType": "semver"}], "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2026-08-10T10:32:53.000Z", "value": "CVE Reserved"}, {"lang": "en", "time": "2026-08-10T10:32:53.000Z", "value": "Public Disclosure"}], "datePublic": "2026-08-10T10:32:53.000Z", "references": [{"url": "https://github.com/4xmen/pm2panel", "name": "Product", "tags": ["third-party-advisory"]}, {"url": "https://github.com/4xmen/pm2panel/blob/main/pm2panel.js", "name": "Vulnerable File", "tags": ["technical-description"]}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.", "supportingMedia": [{"type": "text/html", "value": "<p>An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T10:56:39.956Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72573", "state": "PUBLISHED", "dateUpdated": "2026-08-10T18:22:59.699Z", "dateReserved": "2026-08-10T10:32:53.853Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-10T10:40:54.998Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}