Detect CVE-2026-47140 — vm2 Builtin Denylist Bypass via process/inspector Leads to Host RCE in Microsoft Sentinel
Detects exploitation of CVE-2026-47140, a critical sandbox escape in the npm vm2 package (versions <= 3.11.3). Attackers bypass the builtin module denylist using process and inspector/promises references to execute arbitrary code on the host Node.js process. CVSS 10.0. PoC is publicly available.
MITRE ATT&CK
KQL Detection Query
let suspiciousVm2Patterns = dynamic(['inspector', 'promises', 'process.binding', 'process.mainModule', '__proto__', 'constructor.constructor']);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ ('node', 'node.exe')
| where ProcessCommandLine has_any ('vm2', 'new VM', 'new NodeVM')
| join kind=leftouter (
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ('node', 'node.exe')
| summarize NetworkConnections=count(), RemoteIPs=make_set(RemoteIP) by InitiatingProcessId, DeviceId
) on $left.ProcessId == $right.InitiatingProcessId and DeviceId
| join kind=leftouter (
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ('node', 'node.exe')
| where FileName has_any ('id_rsa', '.ssh', 'shadow', 'passwd', '.env', 'credentials')
| summarize SensitiveFileAccess=count() by InitiatingProcessId, DeviceId
) on $left.ProcessId == $right.InitiatingProcessId and DeviceId
| where isnotempty(NetworkConnections) or isnotempty(SensitiveFileAccess)
| extend RiskScore = case(
isnotempty(SensitiveFileAccess), 'Critical',
isnotempty(NetworkConnections), 'High',
'Medium'
)
| project TimeGenerated, DeviceId, DeviceName, AccountName, ProcessId, ProcessCommandLine, NetworkConnections, RemoteIPs, SensitiveFileAccess, RiskScoreDetects Node.js processes that appear to use vm2 and subsequently make unexpected network connections or access sensitive files, indicative of a sandbox escape via CVE-2026-47140.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Node.js applications using vm2 that make network calls as part of normal operation
- Development and testing environments running vm2 sandbox tests
- CI/CD pipelines running automated tests that exercise vm2 code paths
- Security researchers testing vm2 in controlled lab environments
Other platforms for CVE-2026-47140
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1vm2 Sandbox Escape via inspector/promises — Host Code Execution
Expected signal: Sysmon/auditd will log: (1) node process launch with vm2 in path or arguments, (2) file creation event at /tmp/vm2_escape_poc.txt by the node process, (3) a child process or execSync call spawning sh/bash from within node
- Test 2vm2 Escape with Outbound Network Callback (Simulated C2 Beacon)
Expected signal: Network flow logs will show an outbound HTTP connection to example.com originating from the node process PID. EDR should capture the network connect event and correlate it to the parent node process with vm2 in its command line.
- Test 3vm2 Escape via process.binding — Enumerate Host Environment Secrets
Expected signal: File write event at /tmp/vm2_env_harvest.json attributed to node process. Process event showing node with potential vm2-related arguments. EDR may also capture the internal environment variable enumeration if it hooks process.env access.
References (5)
- https://github.com/patriksimek/vm2/security/advisories/GHSA-rp36-8xq3-r6c4
- https://github.com/patriksimek/vm2/commit/a1ed47a98d1cc36cb48c0d566d55889688e0b59b
- https://github.com/patriksimek/vm2/releases/tag/v3.11.4
- https://nvd.nist.gov/vuln/detail/CVE-2026-47140
- https://github.com/advisories/GHSA-rp36-8xq3-r6c4
Unlock Pro Content
Get the full detection package for CVE-2026-47140 including response playbook, investigation guide, and atomic red team tests.