CyberRota Analysis
AI-GeneratedAn OS command injection vulnerability exists in 4xmen/pm2panel, allowing authenticated remote attackers to execute arbitrary system commands on the host due to improper handling of the unsanitized `req.query.id` parameter. This flaw can lead to severe system compromise, as attackers can leverage command chaining to execute malicious commands. Organizations using this software should prioritize remediation to protect their systems from potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.