AG2 0.13.2 to 1.1.0: a newline in a command bypasses SandboxShellTool's allowlist and read-only mode (CVE-2026-113663); fixed in ag2 1.1.1

View raw markdownEdit on GitHub ↗

TL;DR

AG2's SandboxShellTool has two restricted modes, allowed=[...] and readonly=True. From 0.13.2 until 1.1.1 the filter behind both checked for shell operators such as ;, && and | and did not check for newline or carriage return, while the command ran through sh -c. A command the model writes can therefore carry a second, arbitrary statement. On the default LocalEnvironment backend that statement runs on the host as the agent process. Upgrade ag2 to 1.1.1 or later. The autogen package on PyPI, which the advisory also lists, has no fixed release: its newest version, 0.14.1, is inside the affected range. The vendor published the advisory on 2026-09-29, the CVE record followed on 2026-11-05 and the database entry on 2026-11-10.

What happened

The bug. The CNA record (GitHub, published 2026-11-05) says SandboxShellTool configurations using allowed=[...] or readonly=True rely on a filter in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. "The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement." With the default LocalEnvironment backend, the record says the injected statement runs as a host subprocess with the privileges of the agent process.

Who supplies the newline. The advisory states the precondition: the command argument is generated by the model, so content the agent reads can influence it. A web page, a file or a tool result that steers the model into emitting a two-line command is enough. The advisory quotes the library's own docstring: "Commands run via subprocess on the host, so there is no real isolation."

Score. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), supplied by the GitHub CNA. CWE-78 and CWE-184. This file rates it high: the impact is command execution as the agent, and it needs a restricted-mode configuration plus model-steering input.

Versions and the two package names.

Package Affected Fixed Registry on 2026-11-11
ag2 >= 0.13.2, < 1.1.1 1.1.1 newest 1.3.1; 1.1.1 exists
autogen >= 0.13.2, <= 0.14.1 none listed newest 0.14.1

pip index versions autogen shows 0.14.1 as the newest release, so every autogen install from 0.13.2 on is affected and cannot be upgraded past the bug under that name. The CNA record lists both products under vendor ag2ai.

Dates. Vendor advisory 2026-09-29. CVE-2026-113663 published 2026-11-05, updated 2026-11-09. GitHub Advisory Database entry 2026-11-10. The advisory credits elstati0n.

Am I affected?

  1. pip show ag2 autogen 2>/dev/null | grep -E '^(Name|Version)'. ag2 from 0.13.2 up to and including 1.1.0 is affected. autogen from 0.13.2 through 0.14.1 is affected.
  2. grep -rn "SandboxShellTool" --include='*.py' . and look for allowed= or readonly=True. Those two modes are the ones bypassed. A SandboxShellTool with neither already runs any command.
  3. Check the backend. If no environment is passed, it is LocalEnvironment, and commands run on the host.

If you are affected

  • pip install -U 'ag2>=1.1.1'. If your project depends on autogen, switch the dependency to ag2, because no autogen release carries the fix as of 2026-11-11.
  • If an affected agent processed untrusted content while it had a shell tool, review what it ran. If your local AI agent was exploited covers host triage and credential rotation.

Prevention

  • A command allowlist on a string passed to a shell is not a boundary. The advisory's own stronger suggestion is to split arguments and execute directly, without sh -c.
  • Run shell tools in a container or VM with no credentials. Agent sandboxing covers the setup. A "sandbox" tool whose default backend is the host is a naming choice.

Sources

  • CVE Services: CVE-2026-113663, fetched 2026-11-11: GitHub CNA, published 2026-11-05, updated 2026-11-09; description quoted above; both affected products; CVSS 3.1 8.8; references to the vendor advisory, the fix commit and the v1.1.1 release.
  • GitHub Advisory Database: GHSA-2h4w-29cv-2cmv, fetched 2026-11-11: vendor advisory dated 2026-09-29, database entry 2026-11-10; affected and patched ranges for ag2 and autogen; preconditions; the docstring quote; credit. Single vendor source for the mechanism; the CNA record repeats it.
  • pip index versions ag2 and pip index versions autogen, run 2026-11-11: ag2 newest 1.3.1, with 1.1.1 present; autogen newest 0.14.1.
  • Not opened: the fix commit and the v1.1.1 release page. "Fixed in 1.1.1" is the advisory's and the CNA's statement.