AG2/AutoGen SandboxShellTool command filter bypassed via newline injection

AG2 (formerly AutoGen), one of the most widely used open-source multi-agent frameworks, disclosed a high-severity vulnerability on November 10, 2026, according to AG2 SandboxShellTool Newline Injection Bypasses Command Filter from GitHub Security Advisories. The flaw sits in the framework's SandboxShellTool, which blocks shell operators such as semicolons and pipes but not newline characters, letting an attacker smuggle a second shell command past both the tool's allowlist and its read-only restriction to reach arbitrary command execution on the host.

What changed

• CVE-2026-113663 (GHSA-2h4w-29cv-2cmv): severity high, CVSS 3.1 score 8.8, published November 10, 2026.
• Affected versions: ag2 from 0.13.2 up to but not including 1.1.1, fixed in 1.1.1; autogen from 0.13.2 through 0.14.1, with no fix released since the package is deprecated in favor of ag2.
• SandboxShellTool's command filter blocks operators like semicolons, double ampersands and pipes, but omits newline and carriage return characters.
• Because commands run through sh -c, an embedded newline acts as a statement separator just like a semicolon, letting a blocked-looking command followed by a newline and a malicious command pass the filter.
• The bypass defeats both the tool's allowlist mode and its readonly=True restriction, and with the default LocalEnvironment backend, commands run as an uncontained host subprocess rather than inside a real sandbox.

What it means for people who build with AI

The primary attack vector is indirect prompt injection: malicious content placed in a document or in tool output that reaches the agent's LLM can be translated into the injected shell command, triggering the bypass without any direct user action. Since AG2/AutoGen is one of the most widely used open-source agent orchestration frameworks, a sandbox that isn't actually a sandbox, triggerable through prompt injection, is directly relevant to anyone building coding or operations agents with shell-tool access on this framework.

Fix and availability

The fix is tracked under commit 3cd86726bb731eb11d6270f0ef9e50e42b5abb39 in the AG2 repository and is included starting with ag2 version 1.1.1. The autogen package, covering versions 0.13.2 through 0.14.1, has no fix released, since it is deprecated in favor of ag2.

Sources

• AG2 SandboxShellTool Newline Injection Bypasses Command Filter (GitHub Security Advisories, November 10, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.