{"id":"CVE-2026-113663","kind":"vulnerability","aliases":["CVE-2026-113663"],"related":[],"title":"AG2 agent framework: shell filter misses newlines, enabling injected host commands","description":"AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter._filter and contains_shell_operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1.","summary":"AG2, an open-source agent framework, validates sandboxed shell commands by prefix and syntax checks that ignore newline and carriage-return separators. An attacker who can influence an agent's command can run an extra statement, which with the default LocalEnvironment backend runs as a host subprocess with the agent process's privileges.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ag2","ai-agents","ai-tooling","autogen","python"],"not_affected_if":["non-local-sandbox-backend","not-using-sandboxshelltool"],"how_to_check":"- Check the installed `ag2` version with `pip show ag2`; affected versions are from 0.13.2 up to but not including 1.1.1, and autogen from 0.13.2 to 0.14.1.\n- Look for `SandboxShellTool` configured with `allowed=[...]` or `readonly=True` in agent code.\n- Check whether the sandbox uses the default `LocalEnvironment` backend.","fix":"- `ag2` `1.1.1`\n- autogen: fixed range ends at `0.14.1`; no fixed version is stated in the sources for autogen","status":"open","published_at":"2026-11-05T23:16:50+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","triaged_at":"2026-11-05T23:49:32+00:00","updated_at":"2026-11-05T23:49:32+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-05T23:49:32Z","model":"claude-haiku-5-5","output":{"fix":"- `ag2` `1.1.1`\n- autogen: fixed range ends at `0.14.1`; no fixed version is stated in the sources for autogen","reach":"unknown","title":"AG2 agent framework: shell filter misses newlines, enabling injected host commands","impact":"high","summary":"AG2, an open-source agent framework, validates sandboxed shell commands by prefix and syntax checks that ignore newline and carriage-return separators. An attacker who can influence an agent's command can run an extra statement, which with the default LocalEnvironment backend runs as a host subprocess with the agent process's privileges.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["ag2","autogen","ai-agents","python"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Injected statement runs as the agent process on the host","analyst_note":"","how_to_check":"- Check the installed `ag2` version with `pip show ag2`; affected versions are from 0.13.2 up to but not including 1.1.1, and autogen from 0.13.2 to 0.14.1.\n- Look for `SandboxShellTool` configured with `allowed=[...]` or `readonly=True` in agent code.\n- Check whether the sandbox uses the default `LocalEnvironment` backend.","plain_action":"","needs_analyst":false,"not_affected_if":["not-using-sandboxshelltool","non-local-sandbox-backend"],"who_is_affected":"Teams that run AG2 agents with SandboxShellTool using allowed-command lists or read-only mode, especially with the default LocalEnvironment backend, where injected commands run directly on the host. Agents that take untrusted input into shell commands are the main exposure. Teams on versions outside the listed ranges, or not using SandboxShellTool, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4438,"output_tokens":676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113663':14A,17A '-2026':13A,16A '0.13.2':90C,97C '0.14.1':99C '1.1.1':93C,194C 'accept':139C 'addit':157C 'affect':182C 'ag2':1A,18B,27B,82C,92C,192C 'ag2/tools/sandbox/adapter/shell.py':117C 'ag2/tools/sandbox/filter.py':115C 'agent':2A,21B,32B,57B,78B,152C,178C 'agento':88C 'ai':20B,23B 'ai-ag':19B 'ai-tool':22B 'allow':103C,147C 'arbitrari':158C 'attack':52B,150C 'attacker-influenc':149C 'autogen':25B,96C 'avail':186C 'backend':70B,164C 'c':146C 'carriag':48B,134C 'carriage-return':47B,133C 'check':42B 'command':11A,37B,59B,121C,153C 'confidenti':183C 'configur':101C 'contain':111C 'cve':12A,15A 'default':68B,162C 'enabl':8A 'execut':155C 'extra':63B 'filter':5A,129C 'fix':190C 'framework':3A,33B 'host':10A,74B,171C 'ignor':44B 'influenc':55B,151C 'inject':9A,166C 'integr':184C 'issu':188C 'localenviron':69B,163C 'miss':6A 'newlin':7A,45B,131C 'omit':130C 'open':30B,86C 'open-sourc':29B,85C 'oper':113C 'pass':143C 'prefix':39B,122C 'privileg':81B,175C 'process':79B,179C 'python':26B 'raw':140C 'readon':105C 'reject':124C 'reli':107C 'return':49B,135C 'run':61B,71B,168C 'sandbox':35B 'sandboxshelltool':100C 'select':125C 'separ':50B,136C 'sh':145C 'shell':4A,36B,112C,126C 'shelladapter._filter':109C 'sourc':31B,87C 'statement':64B,159C,167C 'string':141C 'subprocess':75B,172C 'syntax':41B,127C 'tool':24B 'true':106C 'use':102C 'valid':34B,119C 'version':193C","nicknames":[],"mitigations":[],"who_affected":"Teams that run AG2 agents with SandboxShellTool using allowed-command lists or read-only mode, especially with the default LocalEnvironment backend, where injected commands run directly on the host. Agents that take untrusted input into shell commands are the main exposure. Teams on versions outside the listed ranges, or not using SandboxShellTool, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ag2","aiagents","aitooling","autogen","high","python"],"campaign_type":null,"first_public_at":"2026-09-29T20:50:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113663","severity":null,"published_at":"2026-11-05T23:16:50+00:00","modified_at":"2026-11-05T23:16:50+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","fetched_at":"2026-11-05T23:48:39+00:00","note":null}],"documents":[{"id":81477,"url":"https://github.com/ag2ai/ag2/commit/3cd86726bb731eb11d6270f0ef9e50e42b5abb39","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81478,"url":"https://github.com/ag2ai/ag2/releases/tag/v1.1.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":81479,"url":"https://github.com/ag2ai/ag2/security/advisories/GHSA-2h4w-29cv-2cmv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-29T20:50:06+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}