{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/ag2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ag2:ag2:*:*:*:*:*:*:*:*","cpe:2.3:a:autogen:autogen:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-113663"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ag2 (\u003e= 0.13.2, \u003c 1.1.1)","autogen (\u003e= 0.13.2, \u003c= 0.14.1)"],"_cs_severities":["high"],"_cs_tags":["command-injection","vulnerability","agent-security"],"_cs_type":"advisory","_cs_vendors":["AG2"],"content_html":"\u003cp\u003eThe \u003ccode\u003eSandboxShellTool\u003c/code\u003e within the AG2 and AutoGen frameworks contains a command injection vulnerability (CVE-2026-113663) due to insufficient input validation. The tool relies on a denylist of shell operators (e.g., \u003ccode\u003e;\u003c/code\u003e, \u003ccode\u003e\u0026amp;\u0026amp;\u003c/code\u003e, \u003ccode\u003e|\u003c/code\u003e) to enforce \u003ccode\u003eallowed\u003c/code\u003e command allowlists and \u003ccode\u003ereadonly=True\u003c/code\u003e modes. Because newline characters (\u003ccode\u003e\\n\u003c/code\u003e, \u003ccode\u003e\\r\u003c/code\u003e) are not included in this denylist, an attacker can embed newlines to chain arbitrary commands. When the tool executes the input using \u003ccode\u003esh -c\u003c/code\u003e, the shell treats the newline as a command separator, successfully executing subsequent malicious instructions. This issue is particularly critical when using the \u003ccode\u003eLocalEnvironment()\u003c/code\u003e backend, which executes commands directly on the host process without containerized isolation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full command execution on the host machine running the agent. This is reachable through indirect prompt injection where an LLM is coerced into providing a command string containing a newline, bypassing intended security boundaries of the sandbox tool.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003eag2\u003c/code\u003e to version 1.1.1 or later.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003eautogen\u003c/code\u003e to version 0.14.2 or later.\u003c/li\u003e\n\u003cli\u003eFor deployments currently unable to patch, ensure that agents using \u003ccode\u003eSandboxShellTool\u003c/code\u003e operate within strictly isolated environments (e.g., containerized sandboxes) rather than the default \u003ccode\u003eLocalEnvironment()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eReview agent logs for shell commands containing unexpected newline characters if the underlying application telemetry captures raw tool inputs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T16:37:20Z","date_published":"2026-11-10T16:37:20Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ag2-shell-injection/","summary":"The SandboxShellTool in AG2 and AutoGen fails to filter newline characters, allowing attackers to bypass command allowlists and read-only restrictions to execute arbitrary shell commands via CVE-2026-113663.","title":"AG2: SandboxShellTool command injection (CVE-2026-113663)","url":"https://feed.craftedsignal.io/briefs/2026-11-ag2-shell-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - AG2","version":"https://jsonfeed.org/version/1.1"}