Autogen (>= 0.13.2, <= 0.14.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/autogen--0.13.2--0.14.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 16:37:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAG2: SandboxShellTool command injection (CVE-2026-113663)https://feed.craftedsignal.io/briefs/2026-11-ag2-shell-injection/Tue, 10 Nov 2026 16:37:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ag2-shell-injection/The SandboxShellTool in AG2 and AutoGen fails to filter newline characters, allowing attackers to bypass command allowlists and read-only restrictions to execute arbitrary shell commands via CVE-2026-113663.The SandboxShellTool within the AG2 and AutoGen frameworks contains a command injection vulnerability (CVE-2026-113663) due to insufficient input validation. The tool relies on a denylist of shell operators (e.g., ;, &&, |) to enforce allowed command allowlists and readonly=True modes. Because newline characters (\n, \r) are not included in this denylist, an attacker can embed newlines to chain arbitrary commands. When the tool executes the input using sh -c, the shell treats the newline as a command separator, successfully executing subsequent malicious instructions. This issue is particularly critical when using the LocalEnvironment() backend, which executes commands directly on the host process without containerized isolation.

Impact

Successful exploitation allows for full command execution on the host machine running the agent. This is reachable through indirect prompt injection where an LLM is coerced into providing a command string containing a newline, bypassing intended security boundaries of the sandbox tool.

Recommendation

  • Update ag2 to version 1.1.1 or later.
  • Update autogen to version 0.14.2 or later.
  • For deployments currently unable to patch, ensure that agents using SandboxShellTool operate within strictly isolated environments (e.g., containerized sandboxes) rather than the default LocalEnvironment().
  • Review agent logs for shell commands containing unexpected newline characters if the underlying application telemetry captures raw tool inputs.
]]>highadvisorycommand-injectionvulnerabilityagent-security