CVE-2026-113663: AG2 SandboxShellTool allowlist and readonly mode bypassed with a newline, letting a steered agent run any shell command
In AG2 0.13.2 up to 1.1.1, SandboxShellTool's restricted modes (allowed=[...] and readonly=True) block ;, &&, | and similar operators but not a newline, and the command then runs through sh -c. A prompt-injected agent can send 'cat file' followed by a newline and any other command. With the default LocalEnvironment that runs on the host. Upgrade ag2 to 1.1.1; the advisory lists no fixed release of the old autogen package name.
What it is
ShellAdapter._filter() checks that the command starts with an allowed prefix and that contains_shell_operator() finds none of >, >>, |, ;, &&, ||, backtick or $(. A newline (or carriage return) is not in that list.
The command is executed as sh -c <command>, and the shell treats an embedded newline like ;, so the second line runs too. readonly=True uses the same filter, so it is bypassed the same way.
Because tool arguments come from the model, text the agent reads (a fetched page, tool output) can trigger this through indirect prompt injection. The default LocalEnvironment backend is a host subprocess with no isolation.
GitHub lists ag2 >= 0.13.2, < 1.1.1 (fixed in 1.1.1) and autogen 0.13.2 through 0.14.1 with no patched version.
How to check
- Run pip show ag2 autogen and see whether ag2 is 0.13.2 or later but below 1.1.1, or autogen is 0.13.2 to 0.14.1.
- Search your code for SandboxShellTool(allowed= or SandboxShellTool(readonly=True.
How to fix
- Upgrade to ag2 1.1.1 or later. If you install the autogen package name, switch to ag2 1.1.1+.
- Run shell tools in a real sandbox (container or VM) rather than LocalEnvironment, and don't treat a command allowlist as a security boundary on its own.
pip show ag2 autogen 2>/dev/null | grep -E '^(Name|Version)'
pip install -U 'ag2>=1.1.1'