Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M

CVE-2026-113663AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

High 8.8

In plain English

A high-severity OS command injection in ag2 from ag2ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 71.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter._filter and contains_shell_operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1.

Affected products (as reported)

Vendor	Product	Versions
ag2ai	ag2	>= 0.13.2, < 1.1.1
ag2ai	autogen	>= 0.13.2, <= 0.14.1

Weakness: CWE-78, CWE-184 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/ag2ai/ag2/security/advisories/GHSA-2h4w-29cv-2cmv x_refsource_CONFIRM
https://github.com/ag2ai/ag2/commit/3cd86726bb731eb11d6270f0ef9e50e42b5abb39 x_refsource_MISC
https://github.com/ag2ai/ag2/releases/tag/v1.1.1 x_refsource_MISC