CVE-2026-113663: AG2 SandboxShellTool command injection via newline separators

Summary

AG2 versions from 0.13.2 through 1.1.1, and autogen from 0.13.2 through 0.14.1, are affected by a flaw in SandboxShellTool when configured with allowed=[...] or readonly=True. The command filter in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py does not treat newline or carriage-return characters as separators, while the raw string is passed to sh -c, so an attacker-influenced agent command can run an additional arbitrary statement. With the default LocalEnvironment backend, that statement runs as a host subprocess with the agent process's privileges, affecting confidentiality, integrity, and availability.

Mitigation

This issue is fixed in ag2 version 1.1.1.

Related items

• MediumThreat actors use agentic AI tooling to find and abuse exposed secretsSimilar attack · Microsoft Security Blog
• HighCVE-2026-88980: Kubeflow Pipelines artifact fetch flaw enables server-side request forgerySimilar attack · NVD/CVE Database
• CriticalCVE-2026-77596: Kubeflow Pipelines authorization bypass in pipeline upload endpointsSimilar attack · NVD/CVE Database
• MediumCVE-2026-88986: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0…Similar attack · NVD/CVE Database
• MediumCVE-2026-88985: Kubeflow Pipelines SQL injection through page_token list API fieldsSimilar attack · NVD/CVE Database