CVE-2026-72573

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72573", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-10T10:32:53.853Z", "datePublished": "2026-08-10T10:40:54.998Z", "dateUpdated": "2026-08-10T18:22:59.699Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T10:56:39.956Z"}, "title": "4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter", "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.</p>"}]}], "affected": [{"vendor": "4xmen", "product": "pm2panel", "versions": [{"version": "0", "status": "affected", "versionType": "semver"}], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/4xmen/pm2panel", "name": "Product", "tags": ["third-party-advisory"]}, {"url": "https://github.com/4xmen/pm2panel/blob/main/pm2panel.js", "name": "Vulnerable File", "tags": ["technical-description"]}], "credits": [{"lang": "en", "value": "Bo'riboy Abdurahmonov", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "timeline": [{"time": "2026-08-10T10:32:53.000Z", "lang": "en", "value": "CVE Reserved"}, {"time": "2026-08-10T10:32:53.000Z", "lang": "en", "value": "Public Disclosure"}], "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-10T10:32:53.000Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T15:53:33.773598Z", "id": "CVE-2026-72573", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T18:22:59.699Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72573", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-10T15:53:33.773598Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T15:56:17.684Z"}}], "cna": {"title": "4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Bo'riboy Abdurahmonov"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "4xmen", "product": "pm2panel", "versions": [{"status": "affected", "version": "0", "versionType": "semver"}], "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2026-08-10T10:32:53.000Z", "value": "CVE Reserved"}, {"lang": "en", "time": "2026-08-10T10:32:53.000Z", "value": "Public Disclosure"}], "datePublic": "2026-08-10T10:32:53.000Z", "references": [{"url": "https://github.com/4xmen/pm2panel", "name": "Product", "tags": ["third-party-advisory"]}, {"url": "https://github.com/4xmen/pm2panel/blob/main/pm2panel.js", "name": "Vulnerable File", "tags": ["technical-description"]}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.", "supportingMedia": [{"type": "text/html", "value": "<p>An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T10:56:39.956Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72573", "state": "PUBLISHED", "dateUpdated": "2026-08-10T18:22:59.699Z", "dateReserved": "2026-08-10T10:32:53.853Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-10T10:40:54.998Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "pm2panel", "vendor": "4xmen", "versions": [{"status": "affected", "version": "0", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en 4xmen/pm2panel (todas las versiones) permite a un atacante remoto autenticado ejecutar comandos de sistema arbitrarios en el host. El gestor pm2panel.js en la l\u00ednea 188 pasa el par\u00e1metro req.query.id sin sanear directamente a exec(\u2019pm2 restart \u2019 + id) sin validaci\u00f3n de entrada ni escape de shell, lo que permite el encadenamiento de comandos a trav\u00e9s de puntos y coma u otros metacaracteres de shell."}], "id": "CVE-2026-72573", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72573", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T15:53:33.773598Z", "version": "2.0.3"}}]}, "published": "2026-08-10T11:17:30.010", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/4xmen/pm2panel"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/4xmen/pm2panel/blob/main/pm2panel.js"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pm2panel", "source": "cna", "vendor": "4xmen"}, "product": "pm2panel", "vendor": "4xmen"}], "created": "2026-08-10T13:00:04.716551+00:00", "updated": "2026-08-11T14:24:52.285548+00:00", "vendors": ["4xmen", "4xmen$PRODUCT$pm2panel"]}