CVE-2026-47208 Sumo Logic CSE · Sumo

Detect CVE-2026-47208: vm2 Sandbox Breakout via Promise Species in Sumo Logic CSE

Detects exploitation of CVE-2026-47208, a critical sandbox escape vulnerability in the vm2 Node.js library (versions <= 3.11.3). Attackers can abuse the Promise species pattern to break out of the vm2 sandbox and execute arbitrary code on the host. This vulnerability has a CVSS score of 10.0 and a public PoC is available.

MITRE ATT&CK

Tactic
Execution Privilege Escalation Lateral Movement

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=*process* OR _sourceCategory=*endpoint* OR _sourceCategory=*sysmon*
| where _raw matches /node(|\.exe)/i
| parse regex field=_raw "(?<cmdline>(?:command|CommandLine|cmd)[=: \"']+[^\"'\n]+)" nodrop
| where cmdline matches /vm2/i or cmdline matches /Symbol\.species/i or cmdline matches /__proto__/i or cmdline matches /Promise.*species/i
| eval risk="vm2_suspicious_args"
| union
(
  _sourceCategory=*process* OR _sourceCategory=*endpoint*
  | where _raw matches /ParentImage.*node(|\.exe)/i
  | parse regex field=_raw "(?<child_proc>Image[=: \"']+[^\"'\n]+)" nodrop
  | where child_proc matches /(sh|bash|cmd\.exe|powershell\.exe|python|curl|wget|perl)/i
  | eval risk="suspicious_child_from_node"
)
| count by _sourceHost, risk, cmdline
| sort by _count desc
critical severity medium confidence

Sumo Logic query detecting vm2 sandbox escape exploitation through Promise species abuse. Identifies suspicious Node.js argument patterns and unexpected child process spawning.

Data Sources

Sumo Logic Cloud SIEMEndpoint logsSysmon logs

False Positives & Tuning

  • Legitimate server-side JavaScript sandboxing using vm2 with Promise-heavy workloads
  • CI/CD jobs that run Node.js scripts followed by shell commands as part of normal build steps
  • Node.js microservices that spawn subprocesses for data processing
  • Development environments where engineers iterate on vm2-based sandbox code

Other platforms for CVE-2026-47208

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1vm2 Promise Species Sandbox Escape - Basic PoC

    Expected signal: EDR should record: node process executing with command line containing vm2 and Promise/species keywords; file write event to /tmp/vm2_escape_proof.txt from the node process.

  2. Test 2vm2 Sandbox Escape with Child Process Spawn

    Expected signal: EDR process tree: node.exe spawning bash as child process. Sysmon Event ID 1 or auditd EXECVE records showing parent process as node and child as bash with the -c flag.

  3. Test 3Vulnerable vm2 Version Inventory Check

    Expected signal: File read events for package.json files under node_modules/vm2/ paths. The find command execution and subsequent node invocations should appear in process telemetry.

Last updated: 2026-06-20 Research depth: standard
References (5)

Unlock Pro Content

Get the full detection package for CVE-2026-47208 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0002ExecutionTA0004Privilege EscalationTA0008Lateral Movement

Related Techniques

T1059.007JavaScriptT1203Exploitation for Client ExecutionT1068Exploitation for Privilege Escalation

Same Tactic: Execution

Popular Detections