CVE-2026-113663: 
Python vulnerability analysis and mitigation

CVE-2026-113663 is an OS command injection vulnerability (newline injection) in the SandboxShellTool component of AG2 (formerly AutoGen), an open-source AgentOS framework. The flaw affects ag2 versions >= 0.13.2 and < 1.1.1, and autogen versions >= 0.13.2 through 0.14.1. It was reported by researcher elstati0n, published on November 5, 2026, and fixed in ag2 v1.1.1 (released September 29, 2026, with the CVE disclosed November 5, 2026). The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incomplete denylist (CWE-184) combined with improper OS command neutralization (CWE-78). SandboxShellTool's restricted modes — allowed=[...] and readonly=True — rely on ShellAdapter._filter() and contains_shell_operator() in ag2/tools/sandbox/filter.py to validate commands. The _SHELL_OPERATORS tuple checked for >, >>, |, ;, &&, ||, `, and $(, but omitted \n (newline) and \r (carriage return). Because the raw, unmodified command string was then passed directly to sh -c, a POSIX shell treats an embedded newline identically to a ; statement separator, executing both the allowed prefix command and any injected second command. For example, "cat allowed_file.txt\nrm -rf /anything" passes the allowlist prefix check (cat) and the operator check (no recognized operator), but sh -c executes both statements sequentially. The matches() function only verified the command started with an allowed prefix, never inspecting the remainder of the string (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker with network access to the agent to execute arbitrary shell commands on the host system with the privileges of the agent process. With the default LocalEnvironment() backend — which the codebase itself documents as providing "no real isolation" — this constitutes full host command execution, not merely a container escape. The impact spans all three security dimensions: confidentiality (reading sensitive files such as /etc/passwd, credentials, or private data), integrity (modifying or deleting files, altering system state), and availability (disrupting services or destroying data). Because tool arguments are LLM-generated and can be influenced by content the agent processes (e.g., fetched documents or tool output), indirect prompt injection is a realistic attack path that does not require the operator to write the malicious command directly (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability requires low privileges (authenticated agent access) and no user interaction, with network-accessible attack vector and low complexity, making it straightforward to exploit once access is obtained. The EPSS score is reported as 0.0, reflecting the early disclosure stage. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (GitHub Advisory).

1. Identify a target: Locate a deployment of ag2 (versions >= 0.13.2, < 1.1.1) or autogen (>= 0.13.2, <= 0.14.1) that exposes an agent using SandboxShellTool configured with allowed=[...] or readonly=True and the default LocalEnvironment() backend.
2. Obtain agent access: Authenticate to the agent system with low-privilege credentials, or craft content (e.g., a malicious document, webpage, or tool output) that the agent will process — enabling indirect prompt injection to steer the agent's tool calls.
3. Craft the injection payload: Construct a command string that begins with an allowed prefix (e.g., cat if allowed=['cat']) followed by an embedded newline character (\n) and the arbitrary command to execute. Example: cat /etc/passwd\nrm -rf /tmp/target or echo hi\nid.
4. Submit the command: Pass the crafted command string as the command argument to the run_shell_command tool. The _filter() function validates only that the string starts with cat and contains no recognized shell operators — \n is not in the denylist, so the check passes.
5. Achieve arbitrary execution: The raw string is passed to sh -c "cat /etc/passwd\nrm -rf /tmp/target". The POSIX shell treats \n as a statement separator and executes both commands sequentially as the agent process user.
6. Post-exploitation: Use the arbitrary execution capability to exfiltrate sensitive files, establish persistence, pivot to other systems, or disrupt service availability (GitHub Advisory).

• Logs: Agent execution logs showing run_shell_command invocations with command strings containing literal \n or \r characters embedded between an allowed prefix and a secondary command; unexpected command outputs (e.g., output of id, whoami, uname) appearing in agent tool responses.
• Process: Unexpected child processes spawned by the agent's Python process (e.g., sh -c, rm, curl, wget, bash, id) visible in process trees; processes running as the agent service account performing file system modifications.
• File System: New or modified files in directories writable by the agent process (e.g., /tmp/, the agent's working directory); unexpected deletion of files; presence of web shells, reverse shell scripts, or cron job modifications created by the agent process.
• Network: Outbound network connections from the agent host to unexpected external IP addresses or domains, particularly following agent tool invocations; DNS lookups for attacker-controlled infrastructure initiated by the agent process.

Primary remediation: Upgrade ag2 to version 1.1.1 or later. The fix rewrites restricted mode to parse commands into argv using shlex.split() and execute the checked argv directly (without invoking sh -c), eliminating all shell expansion, separator injection, and substitution attacks by construction. Additionally, \n, \r, <, and & were added to _SHELL_OPERATORS as defense-in-depth, and the READONLY_COMMANDS set was tightened to remove commands capable of writing files or executing other programs (find, file, sort, uniq, env, git diff, etc.) (ag2 Release v1.1.1, Fix Commit). For the autogen package, no patched version was released; users should migrate to ag2 >= 1.1.1. Interim workarounds (if immediate upgrade is not possible): restrict network access to systems running vulnerable agent deployments; avoid using SandboxShellTool with allowed=[...] or readonly=True in untrusted environments; use an isolated container backend (DockerEnvironment or DaytonaEnvironment) rather than LocalEnvironment() to limit blast radius.

The vulnerability was reported by researcher elstati0n and published as GitHub Security Advisory GHSA-2h4w-29cv-2cmv. The fix was co-authored with Claude Opus 5.5 (AI-assisted remediation), which was noted in the commit message. The advisory received coverage from automated vulnerability tracking services including VulDB, CVEFeed, and SecurityVulnerability.io shortly after disclosure. Social media activity was observed on Mastodon (infosec.exchange, mastodon.social) and Bluesky, primarily from CVE tracking bots and security news aggregators. Red Hat tracked the issue via Bugzilla (Bug 2567979) with high severity classification (GitHub Advisory, Red Hat Bugzilla).