CVE-2026-113663

AG2 restricted shell commands can be bypassed with a line break

AG2AI · AG2 / autogen SandboxShellTool

First documented disclosure · Review checkpoint

Summary

An agent command can append an extra shell statement despite read-only or explicit allowlist settings.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The researcher demonstrated filter bypass and shell interpretation in a controlled test. No malicious exploitation is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The filter checks prefixes and selected shell operators but omits line separators; execution then passes the raw string to a shell.

Conditions required

An attacker can influence a tool command, including through content processed by the agent. The restricted SandboxShellTool configuration is used.

Potential impact

The default LocalEnvironment runs a host subprocess with agent privileges; container backends have their own isolation boundaries.

Affected versions and configurations

ag2 >=0.13.2 and <1.1.1; autogen >=0.13.2 and <=0.14.1.

Fix and mitigation status

ag2 1.1.1. The advisory specifies no patched autogen version.

Practical next steps

Upgrade to fixed ag2, review the actual environment backend and avoid interpreting restricted commands through an unrestricted shell.

Operating lesson

Validate the syntax the execution engine will interpret, not only a command prefix.

Evidence and limits

The release and advisory were public September 29. November 5 is CVE publication. The local backend’s name does not imply process isolation.

Sources