Detect CVE-2026-47137 — vm2 Sandbox Escape via nesting:true Bypass (RCE) in Google Chronicle
Detects exploitation of CVE-2026-47137, a critical sandbox escape vulnerability in the vm2 Node.js library (<=3.11.3). This bypass circumvents the CVE-2023-37903 patch by abusing the nesting:true configuration option without an explicit require, enabling full remote code execution from within a sandboxed context. CVSS 10.0.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2026_47137_vm2_sandbox_escape {
meta:
author = "df00tech Detection Engineering"
description = "Detects CVE-2026-47137 vm2 nesting:true sandbox escape leading to RCE"
severity = "CRITICAL"
confidence = "HIGH"
mitre_attack = "T1059, T1055, T1068"
cve = "CVE-2026-47137"
events:
$e1.metadata.event_type = "PROCESS_LAUNCH"
$e1.target.process.file.full_path = /(?i)node(\.exe)?$/
(
$e1.target.process.command_line = /(?i)vm2/
or $e1.target.process.command_line = /(?i)nesting[\s:=]+true/
)
$e1.principal.hostname = $host
$e2.metadata.event_type = "PROCESS_LAUNCH"
$e2.principal.hostname = $host
$e2.principal.process.file.full_path = /(?i)node(\.exe)?$/
(
$e2.target.process.file.full_path = /(?i)(sh|bash|dash|zsh|cmd\.exe|powershell(\.exe)?)$/
or $e2.target.process.command_line = /(?i)(child_process|execSync|spawnSync|execFileSync)/
)
match:
$host over 2m
condition:
$e1 and $e2
}Chronicle YARA-L 2.0 rule correlating Node.js process launches referencing vm2 or nesting:true with subsequent shell spawning within a two-minute window on the same host, detecting CVE-2026-47137 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate server-side rendering engines using vm2 for template sandboxing that spawn shell scripts for asset compilation
- Cloud Functions or similar FaaS environments built on Node.js with vm2 isolation layers
- Internal tooling platforms that sandbox user-submitted Node.js snippets and call system utilities for resource management
Other platforms for CVE-2026-47137
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1vm2 nesting:true Sandbox Escape via CVE-2026-47137
Expected signal: Sysmon EventID 1 showing node process spawning with vm2 in command line; child_process.execSync call visible in process arguments; file creation event for /tmp/vm2_escape_proof.txt
- Test 2vm2 Vulnerable Version Installation and Verification
Expected signal: npm install process spawning with [email protected] argument; file creation events under /tmp/vm2_test/node_modules/vm2/; network connection to npm registry (registry.npmjs.org:443)
- Test 3vm2 Reverse Shell Simulation Post-Escape
Expected signal: Network connection from node process to 127.0.0.1:9999 (or configured beacon host); curl child process spawned from Node.js parent; DNS/HTTP request with CVE identifier in URI path
- Test 4vm2 nesting Bypass with Prototype Chain Traversal (Variant)
Expected signal: Node.js process with vm2 in command line; fs.writeFileSync call resulting in file creation event at /tmp/vm2_variant_proof.txt; no child process spawned in this variant
References (6)
- https://github.com/patriksimek/vm2/security/advisories/GHSA-m4wx-m65x-ghrr
- https://github.com/patriksimek/vm2/commit/01a7552add345d5a6862623884e6b79a85bf0568
- https://github.com/patriksimek/vm2/commit/86ab819f202c3a8dad88cef5705f2e416c5188d7
- https://github.com/patriksimek/vm2/releases/tag/v3.11.4
- https://nvd.nist.gov/vuln/detail/CVE-2026-47137
- https://github.com/advisories/GHSA-m4wx-m65x-ghrr
Unlock Pro Content
Get the full detection package for CVE-2026-47137 including response playbook, investigation guide, and atomic red team tests.