CVE-2026-47208 CrowdStrike LogScale · LogScale

Detect CVE-2026-47208: vm2 Sandbox Breakout via Promise Species in CrowdStrike LogScale

Detects exploitation of CVE-2026-47208, a critical sandbox escape vulnerability in the vm2 Node.js library (versions <= 3.11.3). Attackers can abuse the Promise species pattern to break out of the vm2 sandbox and execute arbitrary code on the host. This vulnerability has a CVSS score of 10.0 and a public PoC is available.

MITRE ATT&CK

Tactic
Execution Privilege Escalation Lateral Movement

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=ProcessRollup2
| CommandLine = /vm2/i OR CommandLine = /Symbol\.species/i OR CommandLine = /__proto__/i
| ImageFileName = /node(\.exe)?$/i
| eval vm2_args_detected=1
| join type=inner (
    #event_simpleName=ProcessRollup2
    | ParentBaseFileName = /node(\.exe)?$/i
    | FileName IN ["sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "python", "python3", "curl", "wget", "nc", "ncat", "perl", "ruby"]
    | eval suspicious_child=1
  ) ON [aid, ParentProcessId=ProcessId]
| table _time, ComputerName, UserName, ImageFileName, CommandLine, FileName, ParentBaseFileName
| sort -_time
critical severity high confidence

CrowdStrike Falcon query detecting vm2 sandbox escape exploitation. Joins Node.js processes running vm2/Promise-species patterns with suspicious child processes to identify successful sandbox breakouts.

Data Sources

CrowdStrike Falcon Endpoint ProtectionCrowdStrike Process Telemetry

Required Tables

ProcessRollup2

False Positives & Tuning

  • Managed Node.js environments where vm2 is used legitimately and admins also run shell commands
  • Containerized Node.js applications that spawn shell commands as part of health checks or entrypoints
  • Security tools running vm2 sandbox tests and comparing results via shell utilities
  • Node.js serverless functions that use vm2 and have shell access via SDK calls

Other platforms for CVE-2026-47208

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1vm2 Promise Species Sandbox Escape - Basic PoC

    Expected signal: EDR should record: node process executing with command line containing vm2 and Promise/species keywords; file write event to /tmp/vm2_escape_proof.txt from the node process.

  2. Test 2vm2 Sandbox Escape with Child Process Spawn

    Expected signal: EDR process tree: node.exe spawning bash as child process. Sysmon Event ID 1 or auditd EXECVE records showing parent process as node and child as bash with the -c flag.

  3. Test 3Vulnerable vm2 Version Inventory Check

    Expected signal: File read events for package.json files under node_modules/vm2/ paths. The find command execution and subsequent node invocations should appear in process telemetry.

Last updated: 2026-06-20 Research depth: standard
References (5)

Unlock Pro Content

Get the full detection package for CVE-2026-47208 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0002ExecutionTA0004Privilege EscalationTA0008Lateral Movement

Related Techniques

T1059.007JavaScriptT1203Exploitation for Client ExecutionT1068Exploitation for Privilege Escalation

Same Tactic: Execution

Popular Detections