An OS command injection vulnerability in 4xmen/pm2panel allows an authenticated remote attacker to execute arbitrary system commands on the host.

The vulnerability is an OS command injection (CWE-78) occurring in the pm2panel.js handler. The application fails to sanitize the req.query.id parameter before passing it to an exec call, allowing an authenticated attacker to inject arbitrary shell commands.

With a CVSS score of 8.8, this vulnerability poses a severe risk to host integrity. An attacker can gain full control over the host system, potentially leading to unauthorized data access, lateral movement within the network, or complete system compromise.

Immediate Action: Since no specific patch version is currently identified, users should restrict access to the application to trusted users only. Monitor the project repository at https://github.com/4xmen/pm2panel for security updates.

Proactive Monitoring: Review system and application logs for unusual command execution patterns, especially those involving pm2 or unexpected shell metacharacters such as semicolons.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block requests containing shell metacharacters or suspicious command patterns in the id query parameter.

Public Exploit Available: No

This vulnerability represents a significant risk to host security. Administrators should restrict access to the affected software immediately and monitor the vendor repository for a fix that implements proper input validation and shell escaping.