CVE-2026-72573: 4xmen/pm2panel RCE Vulnerability

CVE-2026-72573 Overview

CVE-2026-72573 is an operating system (OS) command injection vulnerability affecting all versions of 4xmen/pm2panel, a web-based control panel for the PM2 Node.js process manager. The flaw resides in the pm2panel.js request handler, which passes the unsanitized req.query.id parameter directly into a shell exec() call. An authenticated remote attacker can inject shell metacharacters such as semicolons to chain arbitrary commands. Successful exploitation results in arbitrary command execution under the privileges of the Node.js process hosting the panel. The vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on the host, leading to full compromise of confidentiality, integrity, and availability of the underlying system.

Affected Products

4xmen/pm2panel — all versions
pm2panel.js request handler (line 188)
Node.js hosts running pm2panel with exposed authenticated interfaces

Discovery Timeline

2026-08-10 - CVE-2026-72573 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72573

Vulnerability Analysis

The vulnerability exists in the pm2panel.js handler at line 188, which constructs a shell command by concatenating the req.query.id HTTP query parameter with the string pm2 restart . The result is passed to Node.js child_process.exec(), which spawns a shell (/bin/sh -c) to interpret the full command. Because exec() invokes a shell, any unescaped metacharacter in the id parameter is interpreted by that shell rather than treated as literal input.

An authenticated attacker supplies a crafted id value containing shell metacharacters such as ;, |, &&, or backticks. The shell parses these as command separators and executes attacker-controlled commands after the intended pm2 restart invocation. Commands run with the privileges of the pm2panel process, which typically manages other Node.js applications and often runs with elevated permissions.

Root Cause

The root cause is missing input validation and missing shell escaping on user-controlled input before it is concatenated into a shell command string. The handler trusts the req.query.id value implicitly. Neither an allowlist of process identifiers nor a safer API such as child_process.execFile() with argument arrays is used. This matches the pattern described by CWE-78.

Attack Vector

Exploitation requires network access to the pm2panel web interface and valid authentication. The attacker issues an HTTP request to the vulnerable restart endpoint with an id query parameter containing shell metacharacters. For example, a value such as 1;<command> causes the shell to first attempt pm2 restart 1, then execute the injected <command>. Payload delivery requires no user interaction and no complex preconditions once authentication is obtained. Refer to the pm2panel source code for the vulnerable handler.

Detection Methods for CVE-2026-72573

Indicators of Compromise

HTTP requests to pm2panel endpoints where the id query parameter contains shell metacharacters such as ;, |, &, `, $(, or newline characters.
Unexpected child processes spawned by the Node.js process hosting pm2panel, particularly shells like /bin/sh, bash, or utilities such as curl, wget, nc, or python.
New outbound network connections initiated from the pm2panel host to unfamiliar destinations shortly after restart requests.
Modifications to ~/.ssh/authorized_keys, cron entries, or systemd units on the host running pm2panel.

Detection Strategies

Inspect web server and reverse proxy access logs for query strings matching regex patterns such as id=[^&]*[;&|$\n]`.
Correlate process creation telemetry with the pm2panel parent process to flag any non-pm2 child executions.
Alert on shell interpreter invocations whose command line contains pm2 restart followed by additional operators.

Monitoring Recommendations

Enable verbose HTTP request logging on the pm2panel interface, capturing full query strings for retroactive investigation.
Forward host process and network telemetry to a centralized analytics platform to enable cross-source correlation.
Baseline the normal set of child processes for the pm2panel service and alert on deviations.

How to Mitigate CVE-2026-72573

Immediate Actions Required

Restrict network access to the pm2panel interface to trusted management networks or VPN clients only.
Rotate all pm2panel credentials and enforce strong, unique passwords for every account with access.
Run the pm2panel service under a dedicated low-privilege account without sudo rights or write access to sensitive files.
Audit host logs and process history for prior exploitation indicators before applying containment.

Patch Information

At the time of publication, no vendor-released patch is referenced in the NVD entry for CVE-2026-72573. Monitor the 4xmen/pm2panel GitHub repository for upstream fixes. A proper fix requires replacing exec('pm2 restart ' + id) with execFile('pm2', ['restart', id]) and validating id against an allowlist of known PM2 process identifiers or numeric IDs.

Workarounds

Place pm2panel behind a reverse proxy that strips or rejects query parameters containing shell metacharacters.
Apply a web application firewall (WAF) rule blocking id values that do not match ^[A-Za-z0-9_-]+$.
Disable or remove the pm2panel component and manage PM2 processes via the local pm2 CLI over SSH until a patched release is available.
Deploy mandatory access controls such as AppArmor or SELinux profiles to restrict which binaries the Node.js process may execute.

bash

# Example nginx rule to reject suspicious id parameters
location /pm2panel/ {
    if ($arg_id ~* "[;&|`$\\\\\n\r()<>]") {
        return 400;
    }
    proxy_pass http://127.0.0.1:3000;
}