---
id: 2026-11-ag2-sandboxshelltool-newline-bypasses-allowlist-and-readonly-cve-2026-113663-fixed-1-1-1
title: "AG2 0.13.2 to 1.1.0: a newline in a command bypasses SandboxShellTool's allowlist and read-only mode (CVE-2026-113663); fixed in ag2 1.1.1"
date_disclosed: 2026-09-29
last_updated: 2026-11-11
severity: high
status: patched
ecosystems: [pypi, python, ag2, autogen, agent-frameworks]
tools_affected: ["PyPI `ag2` >= 0.13.2, < 1.1.1", "PyPI `autogen` >= 0.13.2, <= 0.14.1 (no patched release; 0.14.1 is the newest on PyPI)", "agents built with `SandboxShellTool(allowed=[...])` or `SandboxShellTool(readonly=True)`, most of all on the default `LocalEnvironment` backend"]
tags: [cve, ghsa, ag2, autogen, agent-framework, shell-tool, allowlist-bypass, command-injection, prompt-injection, no-fix-on-alias-package, database-date-lag]
---

## TL;DR
AG2's `SandboxShellTool` has two restricted modes, `allowed=[...]` and `readonly=True`. From 0.13.2 until 1.1.1 the filter behind both checked for shell operators such as `;`, `&&` and `|` and did not check for newline or carriage return, while the command ran through `sh -c`. A command the model writes can therefore carry a second, arbitrary statement. On the default `LocalEnvironment` backend that statement runs on the host as the agent process. Upgrade `ag2` to 1.1.1 or later. The `autogen` package on PyPI, which the advisory also lists, has no fixed release: its newest version, 0.14.1, is inside the affected range. The vendor published the advisory on 2026-09-29, the CVE record followed on 2026-11-05 and the database entry on 2026-11-10.

## What happened

**The bug.** The CNA record (GitHub, published 2026-11-05) says `SandboxShellTool` configurations using `allowed=[...]` or `readonly=True` rely on a filter in `ag2/tools/sandbox/filter.py` and `ag2/tools/sandbox/adapter/shell.py` to validate a command prefix and reject selected shell syntax. "The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement." With the default `LocalEnvironment` backend, the record says the injected statement runs as a host subprocess with the privileges of the agent process.

**Who supplies the newline.** The advisory states the precondition: the command argument is generated by the model, so content the agent reads can influence it. A web page, a file or a tool result that steers the model into emitting a two-line command is enough. The advisory quotes the library's own docstring: "Commands run via subprocess on the host, so there is no real isolation."

**Score.** CVSS 3.1 8.8 (`AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`), supplied by the GitHub CNA. CWE-78 and CWE-184. This file rates it high: the impact is command execution as the agent, and it needs a restricted-mode configuration plus model-steering input.

**Versions and the two package names.**

| Package | Affected | Fixed | Registry on 2026-11-11 |
|---|---|---|---|
| `ag2` | >= 0.13.2, < 1.1.1 | 1.1.1 | newest 1.3.1; 1.1.1 exists |
| `autogen` | >= 0.13.2, <= 0.14.1 | none listed | newest 0.14.1 |

`pip index versions autogen` shows 0.14.1 as the newest release, so every `autogen` install from 0.13.2 on is affected and cannot be upgraded past the bug under that name. The CNA record lists both products under vendor `ag2ai`.

**Dates.** Vendor advisory 2026-09-29. CVE-2026-113663 published 2026-11-05, updated 2026-11-09. GitHub Advisory Database entry 2026-11-10. The advisory credits elstati0n.

## Am I affected?

1. `pip show ag2 autogen 2>/dev/null | grep -E '^(Name|Version)'`. `ag2` from 0.13.2 up to and including 1.1.0 is affected. `autogen` from 0.13.2 through 0.14.1 is affected.
2. `grep -rn "SandboxShellTool" --include='*.py' .` and look for `allowed=` or `readonly=True`. Those two modes are the ones bypassed. A `SandboxShellTool` with neither already runs any command.
3. Check the backend. If no environment is passed, it is `LocalEnvironment`, and commands run on the host.

## If you are affected

- `pip install -U 'ag2>=1.1.1'`. If your project depends on `autogen`, switch the dependency to `ag2`, because no `autogen` release carries the fix as of 2026-11-11.
- If an affected agent processed untrusted content while it had a shell tool, review what it ran. [If your local AI agent was exploited](../playbooks/if-your-local-ai-agent-was-exploited.md) covers host triage and credential rotation.

## Prevention

- **A command allowlist on a string passed to a shell is not a boundary.** The advisory's own stronger suggestion is to split arguments and execute directly, without `sh -c`.
- **Run shell tools in a container or VM with no credentials.** [Agent sandboxing](../prevention/agent-sandboxing.md) covers the setup. A "sandbox" tool whose default backend is the host is a naming choice.

## Sources

- [CVE Services: CVE-2026-113663](https://cveawg.mitre.org/api/cve/CVE-2026-113663), fetched 2026-11-11: GitHub CNA, published 2026-11-05, updated 2026-11-09; description quoted above; both affected products; CVSS 3.1 8.8; references to the vendor advisory, the fix commit and the v1.1.1 release.
- [GitHub Advisory Database: GHSA-2h4w-29cv-2cmv](https://github.com/advisories/GHSA-2h4w-29cv-2cmv), fetched 2026-11-11: vendor advisory dated 2026-09-29, database entry 2026-11-10; affected and patched ranges for `ag2` and `autogen`; preconditions; the docstring quote; credit. Single vendor source for the mechanism; the CNA record repeats it.
- `pip index versions ag2` and `pip index versions autogen`, run 2026-11-11: `ag2` newest 1.3.1, with 1.1.1 present; `autogen` newest 0.14.1.
- Not opened: the fix commit and the v1.1.1 release page. "Fixed in 1.1.1" is the advisory's and the CNA's statement.