CVE-2026-113663

Summary

The SandboxShellTool in AG2 and AutoGen versions up to 1.1.1 and 0.14.1 respectively fails to properly sanitize shell commands, allowing attackers to inject additional shell statements via unfiltered newline characters, leading to arbitrary command execution with the agent's privileges.

Exploitability

Exploitation requires low privilege access (PR:L) and no user interaction (UI:N), making it feasible for compromised or insider agents to exploit.

Blast radius

Successful exploitation grants full host-level access to the agent process’s privileges, enabling data theft, system modification, or service disruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to AG2 version 1.1.1 or later, which includes the fix for the command injection flaw in SandboxShellTool.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.