AG2: a newline runs commands past the SandboxShellTool allowlist

01What happened

The GitHub Advisory Database published and reviewed CVE-2026-113663 for AG2 on November 10, 2026, after the National Vulnerability Database published the record on November 5. The AG2 maintainers had disclosed the flaw in the project's own advisory on September 29, 2026, crediting the reporter elstati0n, and shipped the fix in AG2 1.1.1 the same day.

02How it works

SandboxShellTool enforced both of its restricted modes, an explicit allowlist and readonly mode, through a single filter that looked for shell operators. That list left out the newline and carriage return characters, and the command then ran through sh -c, which treats a newline as a statement separator in the same way as a semicolon. A command that opens with an allowed program and continues on a second line therefore passed the check, and both statements ran. The default LocalEnvironment backend provides no isolation, so the second command ran on the host.

03Who is affected

Deployments that hand an agent SandboxShellTool in allowlist or readonly mode are the exposed ones, because those are the modes the filter was meant to enforce. Both the ag2 and the autogen packages are in scope, in the version ranges listed below, and the advisory records no fixed version for autogen.

04What to do

Update ag2 to 1.1.1, whose release notes say restricted mode now splits the command into an argument list and runs it without a shell, and which also drops find, file, sort, uniq and git from the built-in readonly set. Because the advisory lists no fixed autogen version, treat that package's allowlist and readonly modes as unenforced rather than as a security boundary.

Sources 3 links, all fetched

1. 1github.comGitHub Advisory
2. 2github.comProject Advisory
3. 3github.comAG2 1.1.1 Release