CVE-2026-47140 Elastic Security · Elastic

Detect CVE-2026-47140 — vm2 Builtin Denylist Bypass via process/inspector Leads to Host RCE in Elastic Security

Detects exploitation of CVE-2026-47140, a critical sandbox escape in the npm vm2 package (versions <= 3.11.3). Attackers bypass the builtin module denylist using process and inspector/promises references to execute arbitrary code on the host Node.js process. CVSS 10.0. PoC is publicly available.

MITRE ATT&CK

Tactic
Execution Privilege Escalation Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.id, process.entity_id with maxspan=5m
  [process where event.type == "start"
    and process.name : ("node", "node.exe")
    and (process.command_line : "*vm2*" or process.command_line : "*NodeVM*" or process.command_line : "*new VM*")]
  [any where event.category : ("network", "file")
    and (
      (event.category == "network" and network.direction == "egress" and not cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8"))
      or
      (event.category == "file" and file.path : ("*/.ssh/*", "*/etc/shadow", "*/etc/passwd", "*/.env", "*/credentials*", "*/id_rsa*"))
    )
  ]
critical severity high confidence

EQL sequence rule that correlates a Node.js process invocation referencing vm2 with subsequent suspicious network egress or sensitive file access within a 5-minute window.

Data Sources

Elastic Endpoint SecurityAuditbeatFilebeat with Sysmon module

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.network-*logs-endpoint.events.file-*

False Positives & Tuning

  • Legitimate vm2-based code execution sandboxes making authorized external API calls
  • Node.js services that bundle vm2 and access configuration files during startup
  • Penetration testing tools that use vm2 in authorized engagements
  • Cloud function runtimes that use vm2 for tenant isolation with expected egress

Other platforms for CVE-2026-47140

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1vm2 Sandbox Escape via inspector/promises — Host Code Execution

    Expected signal: Sysmon/auditd will log: (1) node process launch with vm2 in path or arguments, (2) file creation event at /tmp/vm2_escape_poc.txt by the node process, (3) a child process or execSync call spawning sh/bash from within node

  2. Test 2vm2 Escape with Outbound Network Callback (Simulated C2 Beacon)

    Expected signal: Network flow logs will show an outbound HTTP connection to example.com originating from the node process PID. EDR should capture the network connect event and correlate it to the parent node process with vm2 in its command line.

  3. Test 3vm2 Escape via process.binding — Enumerate Host Environment Secrets

    Expected signal: File write event at /tmp/vm2_env_harvest.json attributed to node process. Process event showing node with potential vm2-related arguments. EDR may also capture the internal environment variable enumeration if it hooks process.env access.

Last updated: 2026-06-20 Research depth: standard
References (5)

Unlock Pro Content

Get the full detection package for CVE-2026-47140 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0002ExecutionTA0004Privilege EscalationTA0008Lateral Movement

Related Techniques

T1059.007JavaScriptT1203Exploitation for Client ExecutionT1068Exploitation for Privilege EscalationT1552.001Credentials In Files

Same Tactic: Execution

Popular Detections