What is the CVSS score of CVE-2026-72573?

CVE-2026-72573 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of pm2panel are affected by CVE-2026-72573?

A command injection vulnerability in 4xmen/pm2panel (all versions) enables authenticated attackers to execute arbitrary system commands on the host with web server privileges, creating direct risk of…

How to fix or mitigate CVE-2026-72573?

Within 24 hours, inventory all pm2panel deployments, assess production criticality, and restrict network access to trusted internal networks only using firewall rules. Within 7 days, implement a Web Application Firewall with rules blocking shell metacharacters and command separators in the 'id' query parameter, and enforce strict input sanitization on pm2panel's application layer; deploy network segmentation to isolate pm2panel from systems containing sensitive data. Within 30 days, monitor vendor security advisories for CVE-2026-72573 patch availability and establish a deployment plan to apply patches immediately upon release; evaluate alternate process management solutions or plan permanent removal of pm2panel if patch remains unavailable beyond 90 days.

pm2panel CVE-2026-72573

EUVD-2026-55233 HIGH

OS Command Injection (CWE-78)

2026-08-10 TuranSec

GHSA-m6fq-fq43-f9v8

Command Injection Pm2Panel

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable endpoint requires low-privilege authentication; trivial shell injection yields complete host-level command execution with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 11:20 vuln.today

CVE Published

Aug 10, 2026 - 10:40 cve.org

HIGH 8.8

DescriptionCVE.org

An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.

AnalysisAI

OS command injection in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the underlying host with the privileges of the web server process. The root cause is unsanitized user input concatenated directly into a Node.js exec() call in pm2panel.js at line 188, where the query parameter 'id' is appended to 'pm2 restart' without any shell escaping or allowlisting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the attack is trivially reproducible given the straightforward nature of the injection point.

Technical ContextAI

pm2panel is a web-based management interface for PM2, the popular Node.js process manager, maintained by the GitHub project 4xmen/pm2panel. The vulnerability resides in the HTTP request handler in pm2panel.js at line 188, where the application constructs a shell command by string-concatenating an unvalidated user-supplied query parameter: exec('pm2 restart ' + req.query.id). This pattern is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw. Because Node.js's child_process.exec() passes the command string to the system shell (e.g., /bin/sh), an attacker can inject shell metacharacters such as semicolons, pipes, backticks, or $() subshells to chain additional commands. The affected CPE is cpe:2.3:a:4xmen:pm2panel:*:*:*:*:*:*:*:*, confirming all published versions are affected with no version bound from the upstream project.

RemediationAI

No vendor-released patch has been identified at time of analysis - the fix version is not confirmed by any upstream release or advisory. Organizations running pm2panel should immediately restrict access to the interface to trusted internal networks or VPN-only segments, reducing the exploitable attack surface. As a direct code-level compensating control, the exec() call in pm2panel.js line 188 should be replaced with a child_process.execFile() or spawn() call using an allowlist of valid numeric or string process IDs, preventing shell interpretation entirely. Alternatively, input validation rejecting any characters outside [a-zA-Z0-9_-] on the 'id' parameter would block the known injection vectors, though this is less robust than eliminating shell interpretation. If pm2panel cannot be immediately patched, consider replacing it with a maintained alternative PM2 management UI. Monitor https://github.com/4xmen/pm2panel for upstream commits that address line 188.