GHSA-2h4w-29cv-2cmv: AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

Published Nov 5, 2026

Updated

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter.filter and containsshelloperator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ag2 to a version that resolves this vulnerability.
Fixed in 1.1.1

Event History

Nov 5, 2026

CVE Published

via OSV·10:53 PM

Data Sourced

via OSV·10:53 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to host-level impact?

Deployments using SandboxShellTool with allowed=[...] or readonly=True are affected in the stated vulnerable version ranges. With the default LocalEnvironment backend, an injected command runs as a host subprocess with the privileges of the agent process.

What does an attacker need to exploit this issue?

An attacker needs to influence a command executed by an agent through SandboxShellTool. They can use newline or carriage-return separators to append an additional statement after a command that passes the configured prefix validation.

Do the allowed-command and read-only settings prevent exploitation?

No. The vulnerability bypasses both allowed=[...] and readonly=True because the filtering logic does not handle newline and carriage-return separators before the command is passed to sh -c.

What should be done if patching cannot happen immediately?

The provided data identifies the vulnerable condition as use of SandboxShellTool with allowed=[...] or readonly=True. Until the fixed version can be deployed, avoid allowing attacker-influenced agent commands to reach that tool and avoid relying on those settings as command-execution safeguards.

How can I determine whether an environment is affected?

Check whether AG2 is from 0.13.2 through versions before 1.1.1, or whether autogen is from 0.13.2 through 0.14.1, and whether SandboxShellTool uses allowed=[...] or readonly=True. AG2 version 1.1.1 contains the fix.

GHSA-2h4w-29cv-2cmv: AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to host-level impact?

What does an attacker need to exploit this issue?

Do the allowed-command and read-only settings prevent exploitation?

What should be done if patching cannot happen immediately?

How can I determine whether an environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to host-level impact?

What does an attacker need to exploit this issue?

Do the allowed-command and read-only settings prevent exploitation?

What should be done if patching cannot happen immediately?

How can I determine whether an environment is affected?