CVE-2026-44000 — vm2 is an open source vm/sandbox for Node.js. Prior to

title: vm2 Sandbox Escape via Host Promise Resolution — CVE-2026-44000
id: scw-2026-05-13-ai-1
status: experimental
level: critical
description: |
  Detects Node.js processes (node.exe) executing code that attempts to leverage the vm2 sandbox escape vulnerability (CVE-2026-44000). This rule specifically looks for the presence of .then(), .catch(), or .finally() calls within the command line, which are indicative of Promise resolution that could be exploited to cross the sandbox boundary by resolving host objects. This is the primary detection vector for the vulnerability itself.
author: SCW Feed Engine (AI-generated)
date: 2026-05-13
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-44000/
tags:
  - attack.defense_evasion
  - attack.t1550.002
logsource:
    category: process_creation
detection:
  selection:
      Image|contains:
          - 'node.exe'
      CommandLine|contains:
          - '.then(' 
          - '.catch(' 
          - '.finally('
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse