---
id: "CVE-2026-113663"
page: "https://infrastack.ai/live/CVE-2026-113663"
kind: "vulnerability"
aliases: ["CVE-2026-113663"]
title: "AG2 agent framework: shell filter misses newlines, enabling injected host commands"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ag2", "ai-agents", "ai-tooling", "autogen", "python"]
not_affected_if: ["non-local-sandbox-backend", "not-using-sandboxshelltool"]
published_at: "2026-11-05T23:16:50+00:00"
first_seen_at: "2026-11-05T23:48:39+00:00"
updated_at: "2026-11-05T23:49:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113663", "first_seen_at": "2026-11-05T23:48:39+00:00"}]
exploit_sources: []
---

# AG2 agent framework: shell filter misses newlines, enabling injected host commands

Link for people: https://infrastack.ai/live/CVE-2026-113663 (this .md is for agents)

AG2, an open-source agent framework, validates sandboxed shell commands by prefix and syntax checks that ignore newline and carriage-return separators. An attacker who can influence an agent's command can run an extra statement, which with the default LocalEnvironment backend runs as a host subprocess with the agent process's privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `ag2` version with `pip show ag2`; affected versions are from 0.13.2 up to but not including 1.1.1, and autogen from 0.13.2 to 0.14.1.
- Look for `SandboxShellTool` configured with `allowed=[...]` or `readonly=True` in agent code.
- Check whether the sandbox uses the default `LocalEnvironment` backend.

## Fix

- `ag2` `1.1.1`
- autogen: fixed range ends at `0.14.1`; no fixed version is stated in the sources for autogen

## Timeline

- 2026-11-05T23:48:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113663

## Documents

- [advisory] Vendor advisory: github.com https://github.com/ag2ai/ag2/security/advisories/GHSA-2h4w-29cv-2cmv
- [fix] Patch: github.com https://github.com/ag2ai/ag2/commit/3cd86726bb731eb11d6270f0ef9e50e42b5abb39
- [fix] Release notes: github.com https://github.com/ag2ai/ag2/releases/tag/v1.1.1

## From the sources

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter._filter and contains_shell_operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_