Vulnerability · Published Aug 10, 2026 · Assigned by TuranSec

CVE-2026-725734xmen pm2panel - Authenticated OS Command Injection via id Query Parameter

High 8.8

In plain English

A high-severity OS command injection in pm2panel from 4xmen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.6%top 24.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.

Affected products (as reported)

Vendor	Product	Versions
4xmen	pm2panel	0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Product third-party-advisory
Vulnerable File technical-description