The vulnerability in 4xmen pm2panel occurs in the pm2panel.js handler at line 188, where the req.query.id parameter is passed directly to exec('pm2 restart ' + id) without any input sanitization or shell escaping. This improper neutralization of special elements (CWE-78) allows an authenticated remote attacker to inject arbitrary OS commands via shell metacharacters such as semicolons. The vulnerability affects all versions of the product. The CVSS 3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

An authenticated remote attacker can execute arbitrary system commands on the host running pm2panel. This can lead to full system compromise, including unauthorized access, data modification, and service disruption. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the pm2panel interface to trusted users only and consider implementing network-level controls to limit exposure. Input validation or shell escaping should be applied to the req.query.id parameter to prevent command injection.