CVE-2026-113663: AG2 shell command injection in SandboxShellTool

CVE-2026-113663 · Severity: high · CVSS 8.8 · Published 2026-11-05

AG2 is an open-source agent orchestration framework that allows AI agents to execute shell commands in restricted environments. A vulnerability in SandboxShellTool's command filtering allowed attackers to bypass security restrictions by injecting shell operators (like newlines) to execute arbitrary commands with the privileges of the agent process, potentially compromising confidentiality, integrity, and availability of the host system.

Vendors: PyPI.

Quick answers

Is CVE-2026-113663 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-113663 being exploited in the wild.
How severe is CVE-2026-113663?
High severity, with a CVSS score of 8.8, published 5 November 2026.
Which products and versions are affected?
AG2 0.13.2 to 1.1.0; AG2 AutoGen 0.13.2 to 0.14.1; ag2 (PyPI) >= 0.13.2, < 1.1.1, ECOSYSTEM:introduced=0.13.2,fixed=1.1.1; autogen (PyPI) >= 0.13.2, <= 0.14.1, ECOSYSTEM:introduced=0.13.2,last_affected=0.14.1.
Is there a fix for CVE-2026-113663?
Yes. ag2 (PyPI): upgrade to 1.1.1 or later. Until then: Restricted shell mode now executes commands without invoking a shell; ensure you use allowed=[...] or readonly=True configurations and avoid relying on shell features like pipes, redirects, globs, and variable expansion which are no longer available in restricted mode.</anigation> <parameter name="confidence">0.95 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113663 attacked?
It is attacked over the network or with local access.
Am I affected by CVE-2026-113663?
Check whether you run AG2, AG2 AutoGen, ag2 (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ag2 (PyPI): upgrade to 1.1.1 or later
    pip install "ag2>=1.1.1"

Restricted shell mode now executes commands without invoking a shell; ensure you use allowed=[...] or readonly=True configurations and avoid relying on shell features like pipes, redirects, globs, and variable expansion which are no longer available in restricted mode.</anigation> <parameter name="confidence">0.95

Technical details

The vulnerability exists in ShellAdapter._filter and contains_shell_operator functions which fail to filter newline (\n) and carriage return (\r) characters, allowing command injection when the filtered command is passed to sh -c. Even when using allowed=[...] or readonly=True configurations intended to restrict shell execution, attackers could chain arbitrary commands (e.g., "git status & touch x" or "cat f\ntouch x") that execute with host subprocess privileges. The fix changes restricted mode to parse commands into argv once and execute without invoking a shell, preventing post-check expansion.

Affected products

  • AG2 AG2 0.13.2 to 1.1.0
  • AG2 AutoGen 0.13.2 to 0.14.1

Identifiers

  • CVE-2026-113663
  • GHSA-2h4w-29cv-2cmv

Timeline

  • 2026-11-05: disclosed
  • 2026-09-29: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.