Node2Shell CVE-2026-111497 Node.js/Bun Spawning Shell or PoC Script Execution

Suraj A@cytech

•updated yesterday•2•0•12

Detects Linux process creation where a Node.js or Bun runtime spawns a shell or download utility as an anomalous child process (post-exploitation of the Brotli decoder out-of-bounds write, CVE-2026-111497), or where the Node2Shell PoC python script is run.