CVE-2026-47140 — vm2 Builtin Denylist Bypass via process/inspector Leads to Host RCE

let suspiciousVm2Patterns = dynamic(['inspector', 'promises', 'process.binding', 'process.mainModule', '__proto__', 'constructor.constructor']);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ ('node', 'node.exe')
| where ProcessCommandLine has_any ('vm2', 'new VM', 'new NodeVM')
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName in~ ('node', 'node.exe')
    | summarize NetworkConnections=count(), RemoteIPs=make_set(RemoteIP) by InitiatingProcessId, DeviceId
) on $left.ProcessId == $right.InitiatingProcessId and DeviceId
| join kind=leftouter (
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName in~ ('node', 'node.exe')
    | where FileName has_any ('id_rsa', '.ssh', 'shadow', 'passwd', '.env', 'credentials')
    | summarize SensitiveFileAccess=count() by InitiatingProcessId, DeviceId
) on $left.ProcessId == $right.InitiatingProcessId and DeviceId
| where isnotempty(NetworkConnections) or isnotempty(SensitiveFileAccess)
| extend RiskScore = case(
    isnotempty(SensitiveFileAccess), 'Critical',
    isnotempty(NetworkConnections), 'High',
    'Medium'
  )
| project TimeGenerated, DeviceId, DeviceName, AccountName, ProcessId, ProcessCommandLine, NetworkConnections, RemoteIPs, SensitiveFileAccess, RiskScore

index=endpoint OR index=os sourcetype=WinEventLog:Security OR sourcetype=sysmon
| eval process_name=lower(process_name)
| where process_name IN ("node", "node.exe")
| eval cmdline_lower=lower(CommandLine)
| where cmdline_lower LIKE "%vm2%" OR cmdline_lower LIKE "%new vm%" OR cmdline_lower LIKE "%nodevm%"
| join type=left ProcessId [
    search index=endpoint sourcetype=sysmon EventCode=3 Image="*node*"
    | stats count AS net_connections, values(DestinationIp) AS dest_ips BY ProcessId
]
| join type=left ProcessId [
    search index=endpoint sourcetype=sysmon EventCode=11 Image="*node*"
    | where TargetFilename LIKE "%id_rsa%" OR TargetFilename LIKE "%.ssh%" OR TargetFilename LIKE "%shadow%" OR TargetFilename LIKE "%.env%"
    | stats count AS sensitive_file_hits BY ProcessId
]
| where isnotnull(net_connections) OR isnotnull(sensitive_file_hits)
| eval risk=case(
    isnotnull(sensitive_file_hits), "critical",
    isnotnull(net_connections), "high",
    true(), "medium"
  )
| table _time, host, user, ProcessId, CommandLine, net_connections, dest_ips, sensitive_file_hits, risk
| sort -risk, -_time

sequence by host.id, process.entity_id with maxspan=5m
  [process where event.type == "start"
    and process.name : ("node", "node.exe")
    and (process.command_line : "*vm2*" or process.command_line : "*NodeVM*" or process.command_line : "*new VM*")]
  [any where event.category : ("network", "file")
    and (
      (event.category == "network" and network.direction == "egress" and not cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8"))
      or
      (event.category == "file" and file.path : ("*/.ssh/*", "*/etc/shadow", "*/etc/passwd", "*/.env", "*/credentials*", "*/id_rsa*"))
    )
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  username,
  processname,
  "Process Command Line" AS cmdline,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (processname ILIKE '%node%' OR processname ILIKE '%node.exe%')
  AND (
    "Process Command Line" ILIKE '%vm2%'
    OR "Process Command Line" ILIKE '%NodeVM%'
    OR "Process Command Line" ILIKE '%new VM%'
  )
  AND (
    destinationip NOT INCIDR '10.0.0.0/8'
    AND destinationip NOT INCIDR '172.16.0.0/12'
    AND destinationip NOT INCIDR '192.168.0.0/16'
    AND destinationip NOT INCIDR '127.0.0.0/8'
    AND destinationip IS NOT NULL
  )
  AND DATEFORMAT(starttime, 'YYYY-MM-dd') = DATEFORMAT(NOW(), 'YYYY-MM-dd')
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=endpoint/windows OR _sourceCategory=endpoint/linux
| where _raw matches /node(\.exe)?/
| parse regex "(?<cmdline>(?:CommandLine|command_line|cmd)\s*[=:]\s*\S+)" nodrop
| where cmdline matches /vm2|NodeVM|new\s+VM/i
| lookup type=geo destinationip from shared/CIDRlookup on cidr return isPrivate
| where !(isPrivate)
| stats count as suspicious_connections, values(destinationip) as remote_ips, first(_messagetime) as first_seen, last(_messagetime) as last_seen by host, user, cmdline
| where suspicious_connections > 0
| sort by suspicious_connections desc
| fields host, user, cmdline, suspicious_connections, remote_ips, first_seen, last_seen

rule cve_2026_47140_vm2_sandbox_escape {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects vm2 sandbox escape via CVE-2026-47140 — builtin denylist bypass via process/inspector/promises"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/patriksimek/vm2/security/advisories/GHSA-rp36-8xq3-r6c4"
    cve = "CVE-2026-47140"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /node(\.exe)?$/
    (
      $proc.target.process.command_line = /vm2/ or
      $proc.target.process.command_line = /NodeVM/ or
      $proc.target.process.command_line = /new\s+VM\s*\(/
    )
    $proc.principal.asset.hostname = $hostname
    $proc.principal.process.pid = $pid

    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.principal.process.pid = $pid
    $net.principal.asset.hostname = $hostname
    not $net.target.ip = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/

  condition:
    $proc and $net
}

#event_simpleName=ProcessRollup2
| ImageFileName=/node(\.exe)?$/i
| CommandLine=/(vm2|NodeVM|new\s+VM)/i
| join type=inner (
    #event_simpleName=NetworkConnectIP4
    | RemoteAddressIP4!=/^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
    | stats count() AS ext_connections, values(RemoteAddressIP4) AS remote_ips BY TargetProcessId, ComputerName
  ) ON TargetProcessId=ProcessId AND ComputerName
| eval risk_level=if(ext_connections > 5, "critical", if(ext_connections > 1, "high", "medium"))
| fields ComputerName, UserName, ProcessId, CommandLine, ext_connections, remote_ips, risk_level
| sort -ext_connections