CVE-2026-72573

Description

An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec(-pm2 restart - + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.