Pm2Panel
Monthly
OS command injection in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the underlying host with the privileges of the web server process. The root cause is unsanitized user input concatenated directly into a Node.js exec() call in pm2panel.js at line 188, where the query parameter 'id' is appended to 'pm2 restart' without any shell escaping or allowlisting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the attack is trivially reproducible given the straightforward nature of the injection point.
OS command injection in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the underlying host with the privileges of the web server process. The root cause is unsanitized user input concatenated directly into a Node.js exec() call in pm2panel.js at line 188, where the query parameter 'id' is appended to 'pm2 restart' without any shell escaping or allowlisting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the attack is trivially reproducible given the straightforward nature of the injection point.