The vulnerability is a classic OS command injection in 4xmen's pm2panel, allowing an attacker who has authenticated to the web interface to run arbitrary system commands on the host. By sending an id query parameter that is concatenated into a shell command without validation or escaping, the attacker can inject shell metacharacters and chain commands. The impact is full compromise of the host’s confidentiality, integrity, and availability because any command that the service’s user can run may be executed.

All versions of the 4xmen pm2panel application are affected. The specific component is the pm2panel.js handler (line 188) which passes the unsanitized req.query.id directly to a shell command. The vendor is 4xmen and the product is pm2panel.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The vulnerability requires an authenticated user on the web interface; the CVE description does not detail how the attacker gains credentials, so the methods remain speculative. No public exploit has been disclosed yet, but the simple mechanics suggest that an attacker could automate the injection once authenticated.