Detect CVE-2026-47208: vm2 Sandbox Breakout via Promise Species in Microsoft Sentinel
Detects exploitation of CVE-2026-47208, a critical sandbox escape vulnerability in the vm2 Node.js library (versions <= 3.11.3). Attackers can abuse the Promise species pattern to break out of the vm2 sandbox and execute arbitrary code on the host. This vulnerability has a CVSS score of 10.0 and a public PoC is available.
MITRE ATT&CK
KQL Detection Query
let vm2SandboxEscape = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("node", "node.exe")
| where ProcessCommandLine has_any ("vm2", "VM2")
| where ProcessCommandLine has_any ("Promise", "species", "Symbol.species", "__proto__", "constructor")
| project Timestamp, DeviceName, AccountName, ProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
let suspiciousChildProcs = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node", "node.exe")
| where FileName in~ ("sh", "bash", "cmd.exe", "powershell.exe", "python", "python3", "perl", "ruby", "curl", "wget")
| project Timestamp, DeviceName, AccountName, ProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId;
let npm2VulnPackage = DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "package.json"
| where FolderPath has "vm2"
| project Timestamp, DeviceName, FolderPath, FileName;
vm2SandboxEscape
| union suspiciousChildProcs
| union npm2VulnPackage
| sort by Timestamp descDetects vm2 sandbox breakout attempts by correlating Node.js process executions with Promise/species-related arguments, unexpected child process spawns from Node.js, and presence of vm2 package files.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Node.js applications using vm2 for sandboxing with Promise-based code patterns
- Security researchers testing vm2 in authorized lab environments
- Automated package auditing tools scanning vm2 installations
- CI/CD pipelines running Node.js test suites that exercise Promise functionality
Other platforms for CVE-2026-47208
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1vm2 Promise Species Sandbox Escape - Basic PoC
Expected signal: EDR should record: node process executing with command line containing vm2 and Promise/species keywords; file write event to /tmp/vm2_escape_proof.txt from the node process.
- Test 2vm2 Sandbox Escape with Child Process Spawn
Expected signal: EDR process tree: node.exe spawning bash as child process. Sysmon Event ID 1 or auditd EXECVE records showing parent process as node and child as bash with the -c flag.
- Test 3Vulnerable vm2 Version Inventory Check
Expected signal: File read events for package.json files under node_modules/vm2/ paths. The find command execution and subsequent node invocations should appear in process telemetry.
References (5)
- https://github.com/patriksimek/vm2/security/advisories/GHSA-76w7-j9cq-rx2j
- https://github.com/patriksimek/vm2/commit/a462655009669c3124ee39498121651597529ea8
- https://github.com/patriksimek/vm2/releases/tag/v3.11.4
- https://nvd.nist.gov/vuln/detail/CVE-2026-47208
- https://github.com/advisories/GHSA-76w7-j9cq-rx2j
Unlock Pro Content
Get the full detection package for CVE-2026-47208 including response playbook, investigation guide, and atomic red team tests.