Detect vm2 Sandbox Escape via Shared Buffer Pool Host-Memory Disclosure (CVE-2026-92947) in IBM QRadar
Detects usage and exploitation of the vm2 npm package versions <= 3.11.6, which contain a critical sandbox escape (CVE-2026-92947, CVSS 10.0). Sandboxed guest code can read and write host-realm memory by abusing Node.js's shared internal Buffer allocation pool (Buffer.allocUnsafe / Buffer.poolSize), allowing cross-realm memory disclosure and tampering that defeats vm2's isolation (CWE-200, CWE-653, CWE-668). This detection surfaces vulnerable vm2 installs in running Node.js processes, package manifests, and lockfiles, and flags Node processes exhibiting buffer-pool-abuse telemetry consistent with the public PoC (GHSA-fcqc-726x-5wfc). Fixed in vm2 3.11.7.
MITRE ATT&CK
- Tactic
- Defense Evasion Execution Collection
QRadar Detection Query
SELECT QIDNAME(qid) AS event, sourceip, username, "Process Name" AS process, "Command Line" AS cmd, "Filename" AS filename, "File Path" AS filepath
FROM events
WHERE ("File Path" ILIKE '%node_modules%vm2%'
OR "Command Line" ILIKE '%vm2%'
OR "Command Line" ILIKE '%allocUnsafe%'
OR "Command Line" ILIKE '%poolSize%')
ORDER BY starttime DESC LAST 7 DAYSReturns QRadar DSM-parsed process and file events referencing vm2 package paths or the Buffer-pool exploit primitives.
Data Sources
Required Tables
False Positives & Tuning
- SBOM/dependency inventory jobs reading vm2 files
- Already-patched vm2 3.11.7+ installs
- CI agents performing npm install of packages that bundle vm2
Other platforms for CVE-2026-92947
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Install vulnerable vm2 version (lab)
Expected signal: File create events for /tmp/vm2lab/node_modules/vm2/package.json and process events for npm/node install.
- Test 2Run Node process referencing vm2 and Buffer pool primitives
Expected signal: ProcessRollup/DeviceProcessEvents record a node process command line containing 'vm2', 'allocUnsafe', and 'poolSize'.
- Test 3Windows Node vm2 invocation (lab)
Expected signal: DeviceProcessEvents / Windows 4688 records node.exe with a command line containing vm2 and Buffer-pool keywords.
References (6)
- https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc
- https://nvd.nist.gov/vuln/detail/CVE-2026-92947
- https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089
- https://github.com/patriksimek/vm2/releases/tag/v3.11.7
- https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool
- https://github.com/advisories/GHSA-fcqc-726x-5wfc
Response Playbook
Triage
- Identify the host and process: determine which Node.js application loaded vm2 and capture the full process command line and working directory.
- Confirm the installed vm2 version by inspecting node_modules/vm2/package.json and the project's package-lock.json/yarn.lock; any version <= 3.11.6 is vulnerable.
- Assess exposure: determine whether the vm2 instance executes untrusted or user-supplied code (plugin engines, serverless eval, template rendering), which is the precondition for exploitation.
- Review recent process telemetry for Buffer.allocUnsafe / Buffer.poolSize usage or crashes/segfaults in the Node process that may indicate exploitation attempts.
Containment
- Upgrade vm2 to 3.11.7 or later across all affected services, or remove vm2 entirely in favor of an out-of-process/isolate-based sandbox (e.g. isolated-vm).
- For services that cannot be patched immediately, disable or gate the feature that evaluates untrusted code in vm2 and isolate the host at the network level.
- Rotate any secrets, tokens or keys that were resident in the memory of a Node.js process running vulnerable vm2 exposed to untrusted input.
Evidence Collection
- Preserve node_modules/vm2 contents, package-lock.json/yarn.lock, and the application source that invokes vm2 for version and usage confirmation.
- Capture a memory dump and process environment of the affected Node.js process if active exploitation is suspected, before remediation.
- Export process execution, file access and network logs for the host covering the window the vulnerable service was reachable.
Escalation Criteria
- !Escalate to incident response if the vulnerable vm2 instance was exposed to untrusted/user-supplied code and evidence of memory disclosure or arbitrary host code execution is present.
- !Escalate if secrets, credentials or customer data could have resided in the affected process memory, triggering data-breach handling.
- !Escalate to the application owners and change management if emergency patching to 3.11.7 requires a production deployment outside the normal window.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
node_modules/vm2/package.json and lockfile entries showing a version <= 3.11.6 - >
Node.js process memory dumps containing cross-realm Buffer references or leaked host objects - >
Application logs showing evaluation of untrusted scripts, segfaults, or unexpected Buffer allocation errors
Tuning Guidance
Baseline which applications legitimately bundle vm2 and confirm they are on 3.11.7+. Suppress alerts for known-patched installs and for SBOM/dependency-scanning tooling that routinely reads node_modules. Prioritize alerts where the Node.js process is internet-facing or evaluates untrusted input, and treat the allocUnsafe/poolSize command-line indicators as higher-fidelity exploitation signals rather than mere presence of the package.
Hunting Queries
Enumerate hosts with vm2 package manifests to inventory potentially vulnerable installs, then verify versions against 3.11.7.
DeviceFileEvents | where FolderPath has_cs "node_modules" and FolderPath has_cs "vm2" and FileName =~ "package.json" | project Timestamp, DeviceName, FolderPathindex=* sourcetype=osquery:results path="*node_modules*vm2*package.json" | stats values(path) by hostAtomic Red Team Tests
Installs vm2 3.11.6 to produce a vulnerable package artifact under node_modules for detection validation.
Command
mkdir -p /tmp/vm2lab && cd /tmp/vm2lab && npm init -y >/dev/null 2>&1 && npm install [email protected]Cleanup
rm -rf /tmp/vm2labExpected Telemetry
File create events for /tmp/vm2lab/node_modules/vm2/package.json and process events for npm/node install.
Expected Detection
KQL/SPL file-artifact rules match the vm2 package.json path under node_modules.
Executes a Node.js one-liner that references vm2 and the Buffer-pool primitives used by the PoC to generate process command-line telemetry.
Command
node -e "const {VM}=require('/tmp/vm2lab/node_modules/vm2'); const b=Buffer.allocUnsafe(8); console.log('poolSize', Buffer.poolSize, b.length);"Cleanup
echo 'no artifacts to clean'Expected Telemetry
ProcessRollup/DeviceProcessEvents record a node process command line containing 'vm2', 'allocUnsafe', and 'poolSize'.
Expected Detection
Process-based rules match on the node command line containing vm2/allocUnsafe/poolSize indicators.
Runs a Node.js command on Windows referencing vm2 to validate Windows process telemetry coverage.
Command
node.exe -e "console.log('vm2 allocUnsafe poolSize test'); require('vm2');"Cleanup
echo doneExpected Telemetry
DeviceProcessEvents / Windows 4688 records node.exe with a command line containing vm2 and Buffer-pool keywords.
Expected Detection
KQL DeviceProcessEvents and CrowdStrike CQL rules match the node.exe command line indicators.