Description

An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-10T11:17:30.010Z",
  "pubdate": "2026-08-10T11:17:30.010Z",
  "executiveSummary": "An OS command injection vulnerability exists in 4xmen/pm2panel across all versions, which allows an authenticated remote attacker to execute arbitrary system commands on the host operating system.\nThe security flaw resides in the application's request handling logic, where user-supplied input parameters are concatenated directly into a system shell execution function without prior validation, sanitization, or proper escaping.\nSuccessful exploitation of this vulnerability yields complete remote code execution capabilities on the underlying host system, presenting critical risk implications regarding confidentiality, integrity, and availability.\nTo achieve successful exploitation, an adversary requires authenticated access to the application endpoints, after which malicious payloads can be supplied via HTTP request parameters to manipulate the execution flow and break out of the intended shell context.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure handling of user-supplied input within the application source code.\nSpecifically, the vulnerable component is located in the pm2panel.js handler at line 188, where the unsanitized req.query.id parameter is passed directly into the Node.js child_process exec function.\nThe underlying execution sink constructs a command string dynamically using concatenation, specifically executing 'pm2 restart ' + id.\nBecause the input is not validated, filtered, or subjected to shell escaping, an authenticated remote attacker can inject arbitrary shell metacharacters, such as semicolons, ampersands, or pipe characters, effectively facilitating command chaining.\nThe attack flow begins with the attacker authenticating to the target application and crafting a malicious HTTP GET request targeting the vulnerable endpoint associated with pm2panel.js.\nThe attacker appends shell metacharacters followed by arbitrary system commands to the req.query.id parameter (e.g., injecting '; id' or similar payloads).\nUpon receiving the request, the application evaluates the concatenated string within a system shell context, executing the legitimate pm2 restart command followed immediately by the attacker's injected arbitrary system commands with the privileges of the running Node.js process.\nAffected versions include all iterations of 4xmen/pm2panel, as input validation and parameterized process execution mechanisms are absent throughout the codebase.\nThe network exposure requires HTTP accessibility to the application, and the exploitation prerequisite dictates that the attacker must possess valid authentication credentials to interact with the vulnerable handler."
}