CVE-2026-47208 Elastic Security · Elastic

Detect CVE-2026-47208: vm2 Sandbox Breakout via Promise Species in Elastic Security

Detects exploitation of CVE-2026-47208, a critical sandbox escape vulnerability in the vm2 Node.js library (versions <= 3.11.3). Attackers can abuse the Promise species pattern to break out of the vm2 sandbox and execute arbitrary code on the host. This vulnerability has a CVSS score of 10.0 and a public PoC is available.

MITRE ATT&CK

Tactic
Execution Privilege Escalation Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=5m
  [process where event.type == "start"
    and process.name in ("node", "node.exe")
    and (
      process.command_line like~ "*vm2*"
      or process.command_line like~ "*Symbol.species*"
      or process.command_line like~ "*Promise*species*"
    )
  ] by process.pid
  [process where event.type == "start"
    and process.parent.name in ("node", "node.exe")
    and process.name in ("sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "python", "python3", "curl", "wget", "nc", "ncat", "perl", "ruby")
  ] by process.parent.pid
critical severity high confidence

EQL sequence detection: identifies a Node.js process with vm2/Promise-species arguments followed within 5 minutes by an unexpected child process spawn, indicating sandbox escape.

Data Sources

Elastic Endpoint SecurityAuditbeatWinlogbeat

Required Tables

logs-endpoint.events.process-*auditbeat-*winlogbeat-*

False Positives & Tuning

  • Node.js test frameworks that legitimately spawn shell subprocesses after vm2 execution
  • Deployment scripts using vm2 that subsequently run shell commands as part of normal workflow
  • Monitoring agents on Node.js hosts that spawn processes coincidentally after vm2 activity
  • Gulp/Grunt or similar build tools using vm2 that invoke shell commands

Other platforms for CVE-2026-47208

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1vm2 Promise Species Sandbox Escape - Basic PoC

    Expected signal: EDR should record: node process executing with command line containing vm2 and Promise/species keywords; file write event to /tmp/vm2_escape_proof.txt from the node process.

  2. Test 2vm2 Sandbox Escape with Child Process Spawn

    Expected signal: EDR process tree: node.exe spawning bash as child process. Sysmon Event ID 1 or auditd EXECVE records showing parent process as node and child as bash with the -c flag.

  3. Test 3Vulnerable vm2 Version Inventory Check

    Expected signal: File read events for package.json files under node_modules/vm2/ paths. The find command execution and subsequent node invocations should appear in process telemetry.

Last updated: 2026-06-20 Research depth: standard
References (5)

Unlock Pro Content

Get the full detection package for CVE-2026-47208 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0002ExecutionTA0004Privilege EscalationTA0008Lateral Movement

Related Techniques

T1059.007JavaScriptT1203Exploitation for Client ExecutionT1068Exploitation for Privilege Escalation

Same Tactic: Execution

Popular Detections