{"data":{"id":"91b59ece-e8c8-4757-ae1e-64058328cfab","title":"CVE-2026-113663: AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool…","summary":"AG2 versions from 0.13.2 through 1.1.1, and autogen from 0.13.2 through 0.14.1, are affected by a flaw in SandboxShellTool when configured with allowed=[...] or readonly=True. The command filter in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py does not treat newline or carriage-return characters as separators, while the raw string is passed to sh -c, so an attacker-influenced agent command can run an additional arbitrary statement. With the default LocalEnvironment backend, that statement runs as a host subprocess with the agent process's privileges, affecting confidentiality, integrity, and availability.","solution":"This issue is fixed in ag2 version 1.1.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113663","publishedAt":"2026-11-05T23:16:50.523Z","cveId":"CVE-2026-113663","cweIds":["CWE-78","CWE-184"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["AG2","AutoGen","SandboxShellTool"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"AG2 SandboxShellTool command injection via newline separators","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-06T06:09:43.474Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-06T06:09:48.576Z","patchAvailable":null,"disclosureDate":"2026-11-05T23:16:50.523Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}