Detect CVE-2026-47208: vm2 Sandbox Breakout via Promise Species in Splunk
Detects exploitation of CVE-2026-47208, a critical sandbox escape vulnerability in the vm2 Node.js library (versions <= 3.11.3). Attackers can abuse the Promise species pattern to break out of the vm2 sandbox and execute arbitrary code on the host. This vulnerability has a CVSS score of 10.0 and a public PoC is available.
MITRE ATT&CK
SPL Detection Query
index=* sourcetype IN ("WinEventLog:Security", "linux_secure", "auditd", "ProcessCreate", "sysmon")
| eval process_lower=lower(process)
| eval cmdline_lower=lower(cmdline)
| where (process_lower IN ("node", "node.exe") AND (match(cmdline_lower, "vm2") OR match(cmdline_lower, "symbol\.species") OR match(cmdline_lower, "promise") OR match(cmdline_lower, "__proto__")))
OR (parent_process_lower IN ("node", "node.exe") AND process_lower IN ("sh", "bash", "cmd.exe", "powershell.exe", "python", "python3", "curl", "wget", "perl"))
| eval risk_score=case(
match(cmdline_lower, "symbol\.species") AND match(cmdline_lower, "vm2"), 95,
process_lower IN ("sh","bash","cmd.exe","powershell.exe") AND parent_process_lower IN ("node","node.exe"), 85,
match(cmdline_lower, "vm2") AND match(cmdline_lower, "promise"), 70,
true(), 50
)
| where risk_score >= 70
| table _time, host, user, process, cmdline, parent_process, parent_cmdline, risk_score
| sort -risk_scoreDetects vm2 sandbox escape exploitation via Promise species abuse. Correlates Node.js process events with suspicious argument patterns and unexpected child process spawning.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate Node.js applications exercising Promise-based patterns within vm2 sandboxes
- Authorized penetration testing of Node.js applications
- Developer environments testing vm2 functionality with species overrides
- Build systems running node scripts that spawn shell processes normally
Other platforms for CVE-2026-47208
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1vm2 Promise Species Sandbox Escape - Basic PoC
Expected signal: EDR should record: node process executing with command line containing vm2 and Promise/species keywords; file write event to /tmp/vm2_escape_proof.txt from the node process.
- Test 2vm2 Sandbox Escape with Child Process Spawn
Expected signal: EDR process tree: node.exe spawning bash as child process. Sysmon Event ID 1 or auditd EXECVE records showing parent process as node and child as bash with the -c flag.
- Test 3Vulnerable vm2 Version Inventory Check
Expected signal: File read events for package.json files under node_modules/vm2/ paths. The find command execution and subsequent node invocations should appear in process telemetry.
References (5)
- https://github.com/patriksimek/vm2/security/advisories/GHSA-76w7-j9cq-rx2j
- https://github.com/patriksimek/vm2/commit/a462655009669c3124ee39498121651597529ea8
- https://github.com/patriksimek/vm2/releases/tag/v3.11.4
- https://nvd.nist.gov/vuln/detail/CVE-2026-47208
- https://github.com/advisories/GHSA-76w7-j9cq-rx2j
Unlock Pro Content
Get the full detection package for CVE-2026-47208 including response playbook, investigation guide, and atomic red team tests.