# AG2: a newline runs commands past the SandboxShellTool allowlist

> CVE-2026-113663 is a CVSS 8.8 flaw that lets a newline carry a second command past AG2's SandboxShellTool allowlist.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** AG2
- **Disclosed:** 2026-11-10
- **CVE:** CVE-2026-113663
- **CVSS:** 8.8
- **Affects:** AG2, AutoGen
- **Research by:** elstati0n
- **Primary source:** https://github.com/advisories/GHSA-2h4w-29cv-2cmv
- **Page:** https://theinjection.dev/items/ag2-sandboxshelltool-newline-bypass/

CVE-2026-113663 carries a CVSS 8.8 score for a newline that defeats the command allowlist in AG2's SandboxShellTool. AG2 1.1.1 fixes it, and the advisory lists no fixed version for the autogen package.

## What happened

The GitHub Advisory Database published and reviewed CVE-2026-113663 for AG2 on November 10, 2026, after the National Vulnerability Database published the record on November 5. The AG2 maintainers had disclosed the flaw in the project's own advisory on September 29, 2026, crediting the reporter elstati0n, and shipped the fix in AG2 1.1.1 the same day.

## How it works

SandboxShellTool enforced both of its restricted modes, an explicit allowlist and readonly mode, through a single filter that looked for shell operators. That list left out the newline and carriage return characters, and the command then ran through sh -c, which treats a newline as a statement separator in the same way as a semicolon. A command that opens with an allowed program and continues on a second line therefore passed the check, and both statements ran. The default LocalEnvironment backend provides no isolation, so the second command ran on the host.

## Who is affected

Deployments that hand an agent SandboxShellTool in allowlist or readonly mode are the exposed ones, because those are the modes the filter was meant to enforce. Both the ag2 and the autogen packages are in scope, in the version ranges listed below, and the advisory records no fixed version for autogen.

## What to do

Update ag2 to 1.1.1, whose release notes say restricted mode now splits the command into an argument list and runs it without a shell, and which also drops find, file, sort, uniq and git from the built-in readonly set. Because the advisory lists no fixed autogen version, treat that package's allowlist and readonly modes as unenforced rather than as a security boundary.

## Quick facts

- **CVE:** CVE-2026-113663
- **CVSS:** 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Affected:** ag2 from 0.13.2 up to 1.1.1; autogen from 0.13.2 through 0.14.1
- **Fixed in:** ag2 1.1.1; no fixed version listed for autogen
- **Weakness:** CWE-78 OS command injection, CWE-184 incomplete list of disallowed inputs
- **Disclosed:** September 29, 2026 in ag2ai/ag2; NVD record November 5, 2026
- **Found by:** elstati0n

## Sources

1. [GitHub Advisory](https://github.com/advisories/GHSA-2h4w-29cv-2cmv)
2. [Project Advisory](https://github.com/ag2ai/ag2/security/advisories/GHSA-2h4w-29cv-2cmv)
3. [AG2 1.1.1 Release](https://github.com/ag2ai/ag2/releases/tag/v1.1.1)