NEGATIVE CONTROL: Patched pm2panel_fixed.js using execFile with input sanitization
Exploit request: GET /restart?id=0; touch /tmp/pm2panel_fix_marker
Login: admin/admin (HTTP 200)
Exploit response: 302
Marker file created: NO (expected - fixed version rejects shell metacharacters)