CVE-2026-47137 — vm2 Sandbox Escape via nesting:true Bypass Enables Full RCE (CVSS 10.0)

Vulnerability Overview

CVE-2026-47137 is a critical sandbox escape in the vm2 Node.js library, carrying a CVSS score of 10.0. Classified under CWE-913 (Improper Control of Dynamically-Managed Code Resources), the root cause is an incomplete patch: the fix shipped for CVE-2023-37903 failed to account for the nesting:true configuration option when no explicit require is present. An attacker operating inside a sandboxed vm2 context can abuse this path to break the sandbox boundary entirely, achieving arbitrary code execution in the host Node.js process with no additional privileges required.

Affected Software

• Package: vm2 (npm)
• Vendor: npm ecosystem
• Affected versions: all releases up to and including 3.11.3
• Patch available: No patched release has been published as of the detection's disclosure date (2026-05-29). If your application depends on vm2, you should treat the library as untrustworthy for sandboxing and evaluate migration to maintained alternatives.

Exploitation Status

A public proof-of-concept is available. This is not a theoretical finding — working exploit code has been demonstrated and is accessible to low-sophistication threat actors. The absence of a patch compounds the risk significantly: defenders cannot rely on vendor remediation and must instead detect or contain exploitation attempts at the host and SIEM layer. Any Node.js application that exposes a vm2 sandbox to untrusted input (user-supplied scripts, plugin systems, template engines) should be considered at immediate risk.

How Our Detections Catch It

df00tech ships detection coverage across seven SIEM platforms for this vulnerability:

• Microsoft Sentinel (KQL) — correlates process spawn anomalies originating from Node.js workers with unexpected child process lineage indicative of sandbox escape, combined with vm2-specific module load patterns.
• Splunk (SPL) — hunts for host-level command execution events where the parent process context maps to a known vm2 sandboxed runtime, flagging privilege boundary crossings.
• Elastic (EQL) — uses sequence-based event correlation to identify the sandbox instantiation followed by anomalous syscall or child process activity within the same process tree.
• IBM QRadar (AQL) — queries flow and offense data for Node.js process events that deviate from baseline execution profiles in applications known to use vm2.
• Sumo Logic — log-based rule targeting stderr/stdout artefacts and file system writes consistent with post-escape activity from a vm2 context.
• Chronicle (YARA-L) — UDM event rules matching the characteristic process and network IOCs produced during exploitation, correlated against asset context.
• CrowdStrike (CQL) — sensor-level behavioural detection of the escape primitive: identifies the nesting:true abuse pattern through Node.js VM API call sequences and the resulting unsandboxed execution.

All queries are tuned to reduce false positives by scoping to processes where vm2 is a known dependency. Detection logic focuses on the post-escape execution artefacts rather than the configuration option alone, since nesting:true is a legitimate configuration in non-exploit contexts.

Recommendations

Until a patch is released, the strongest mitigations are: (1) remove or replace vm2 with a maintained sandboxing alternative; (2) restrict untrusted code execution paths at the application layer; (3) deploy the detections below and triage any hits immediately given the public PoC and CVSS 10.0 severity.

Full detection queries, playbooks, and atomic test cases for CVE-2026-47137 are available on the CVE-2026-47137 detection page. Paid subscribers receive the complete KQL, SPL, Elastic EQL, QRadar AQL, Sumo Logic, Chronicle YARA-L, and CrowdStrike CQL rules alongside a purple team atomic test to validate coverage in your environment.