CVE-2026-47210: vm2 Sandbox Escape via JSPI-backed Promise .finally() Species Bypass

Vulnerability Overview

CVE-2026-47210 is a critical sandbox escape vulnerability (CVSS 9.8, CWE-913: Improper Control of Dynamically-Managed Code Resources) in the widely-used npm package vm2. The root cause lies in the interaction between JavaScript Promise Integration (JSPI) and the ECMAScript species pattern — specifically, how Promise.prototype.finally() resolves the constructor used to create its returned promise. By crafting a malicious species accessor on a Promise subclass, an attacker can force vm2 to invoke host-realm constructors from within sandboxed code, bypassing all isolation guarantees. Successful exploitation yields arbitrary code execution on the host with the full privileges of the Node.js process.

Affected Software

All versions of vm2 (npm) up to and including 3.11.3 are affected. No patch has been released as of the disclosure date (2026-05-29). Any Node.js application that uses vm2 to sandbox untrusted code — plugin systems, online code editors, automated grading platforms, serverless function sandboxes — should be treated as directly exposed.

Exploitation Status

A public proof-of-concept exists. This is not a theoretical issue: working exploit code is available, lowering the bar for exploitation to script-kiddie level. Because no vendor patch has been issued, defenders cannot rely on a straightforward upgrade path. The combination of a public PoC, a CVSS score of 9.8, and zero available patch makes this a high-priority containment scenario. Organisations running vm2 in any user-facing or multi-tenant context should assume active exploitation attempts are imminent, if not already occurring.

Detection Coverage

The df00tech detection pack ships rules across seven SIEM platforms for this vulnerability:

• Microsoft Sentinel (KQL) — correlates Node.js process spawn events and module load telemetry for vm2 combined with child process creation or unexpected network egress, flagging the host-escape pivot.
• Splunk (SPL) — hunts process lineage chains where a Node.js process with vm2 in its module path spawns a subprocess or shell outside the expected application tree.
• Elastic EQL — uses event sequences to catch the exploit's characteristic pattern: sandboxed evaluation followed immediately by OS-level execution from the same process.
• IBM QRadar (AQL) — correlates endpoint flow records and process events to surface anomalous child processes attributable to Node.js/vm2 execution contexts.
• Sumo Logic — log-based rule targeting Node.js application logs for unhandled promise resolution errors or species-accessor stack traces indicative of the bypass attempt.
• Chronicle YARA-L — behavioural rule matching UDM events where a Node.js process transitions from sandbox evaluation to host-level file or network access.
• CrowdStrike (CQL) — sensor-level rule detecting the process injection and privilege chain that follows a successful vm2 escape, leveraging CrowdStrike's kernel visibility.

All rules focus on the post-escape behaviour (unexpected child processes, shell spawns, outbound connections) rather than the JavaScript payload itself, making them resilient to payload obfuscation.

Next Steps

Until a patched version of vm2 is released, teams should strongly consider replacing vm2 with an actively maintained alternative (e.g. isolated-vm or a container-based sandbox). Review all internal tooling and third-party dependencies that bundle vm2 transitively. For full detection logic, SIEM-specific queries, and atomic test procedures, visit the CVE-2026-47210 detection page on the df00tech platform.