What is CVE-2026-72573?
This is an OS command injection vulnerability in all versions of 4xmen/pm2panel that allows an authenticated remote attacker to execute arbitrary system commands on the host. The unsanitized `req.query.id` parameter is passed directly to `exec()` in the pm2panel.js handler. It is recommended to shut down the panel and restrict access until an official patch is released.
Azərbaycanca: Bu boşluq 4xmen/pm2panel-in bütün versiyalarında autentifikasiyadan keçmiş uzaqdan hücum edənə hostda ixtiyari sistem əmrlərini icra etməyə imkan verən OS command injection zəifliyidir. pm2panel.js faylında `req.query.id` parametri sanitizə olunmadan birbaşa `exec()` funksiyasına ötürülür. Bu zəiflikdən qorunmaq üçün dərhal paneli bağlamaq və rəsmi yamaq buraxılana qədər girişi məhdudlaşdırmaq tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-78
FAQ2
Under what condition can CVE-2026-72573 be exploited?
This vulnerability can be exploited by an authenticated remote attacker, meaning the attacker must have valid login credentials on the system.
What temporary mitigation measures are recommended for CVE-2026-72573?
It is recommended to immediately shut down the panel and restrict access until an official patch is released.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.