This vulnerability (CVE-2026-72573) in 4xmen pm2panel occurs due to improper neutralization of special elements used in OS commands (CWE-78). Specifically, the pm2panel.js handler at line 188 uses the unsanitized req.query.id parameter directly in the exec('pm2 restart ' + id) call. Because there is no input validation or shell escaping, an authenticated attacker can inject shell metacharacters such as semicolons to execute arbitrary commands on the underlying operating system.

Successful exploitation allows an authenticated remote attacker to execute arbitrary system commands with the privileges of the pm2panel process. This can lead to complete compromise of the host, including confidentiality, integrity, and availability impacts as reflected by the CVSS score of 8.8 (high).

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to restrict access to the pm2panel interface to trusted users only and consider implementing network-level controls to limit exposure. Input validation and sanitization should be applied to the req.query.id parameter to prevent command injection if possible.