Threats affecting pkg:github/4xmen/pm2panel

CVE-2026-72573 is an OS command injection vulnerability in all versions of 4xmen/pm2panel. It allows an authenticated remote attacker to execute arbitrary system commands on the host by exploiting unsanitized input passed to a system exec call. The vulnerability arises because the pm2panel.js handler directly uses the req.query.id parameter without validation or escaping, enabling command chaining via shell metacharacters.