CVE-2026-113663 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
AG2, an open-source agent framework, validates sandboxed shell commands by prefix and syntax checks that ignore newline and carriage-return separators. An attacker who can influence an agent's command can run an extra statement, which with the default LocalEnvironment backend runs as a host subprocess with the agent process's privileges.
first public Sep 29, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run AG2 agents with SandboxShellTool using allowed-command lists or read-only mode, especially with the default LocalEnvironment backend, where injected commands run directly on the host. Agents that take untrusted input into shell commands are the main exposure. Teams on versions outside the listed ranges, or not using SandboxShellTool, can skip it.
Not affected if non-local-sandbox-backend, not-using-sandboxshelltool
Who cares ag2, ai-agents, autogen, python
ag2 version with pip show ag2; affected versions are from 0.13.2 up to but not including 1.1.1, and autogen from 0.13.2 to 0.14.1.SandboxShellTool configured with allowed=[...] or readonly=True in agent code.LocalEnvironment backend.AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter._filter and contains_shell_operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
ag21.1.10.14.1; no fixed version is stated in the sources for autogenNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.