Description

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter._filter and contains_shell_operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T23:16:50.523Z",
  "pubdate": "2026-11-05T23:16:50.523Z",
  "executiveSummary": "A command injection vulnerability exists in AG2 (formerly AutoGen) within the SandboxShellTool component. The flaw arises from insufficient sanitization of shell commands in the filtering logic, specifically failing to account for newline and carriage-return characters when processing allowed commands.\nThis vulnerability allows an attacker-influenced agent to bypass restrictive configurations, such as allowed command lists or readonly modes. By injecting malicious statements separated by line terminators, an attacker can execute arbitrary code on the host operating system.\nThe vulnerability affects AG2 versions from 0.13.2 up to and including 1.1.1, and autogen versions 0.13.2 to 0.14.1. Exploitation occurs locally through the agent's interaction with the LocalEnvironment backend.\nThe impact is significant, as the injected commands execute with the same privileges as the agent process, potentially compromising the confidentiality, integrity, and availability of the host system. The risk is classified as high due to the potential for unrestricted remote code execution within the agent's execution environment.",
  "technicalDetails": "The vulnerability resides in the command validation logic implemented within ag2/tools/sandbox/filter.py (specifically in the contains_shell_operator function) and ag2/tools/sandbox/adapter/shell.py (in ShellAdapter._filter).\nThe root cause is an incomplete blocklist-based filtering mechanism. While the application intends to restrict shell command execution using the allowed parameter or by enforcing readonly=True, the filter fails to sanitize newline (\\n) and carriage-return (\\r) characters. Consequently, when the validated raw string is passed to sh -c for execution, the shell interprets these control characters as statement separators.\nIn a typical attack flow, an attacker provides input to the agent designed to execute a benign command prefix, followed by a newline or carriage-return character, and then a malicious payload. For example, if 'ls' is permitted, an attacker might submit 'ls\\n<malicious_command>'.\nThe validation logic only examines the command prefix, confirming it aligns with allowed patterns, but the subsequent malicious statement is passed through the shell-interpreter unchecked. Because the SandboxShellTool relies on the LocalEnvironment backend by default, the underlying shell spawned by sh -c executes the injected payload as a host subprocess.\nThis bypasses the intended sandbox constraints, allowing the attacker to escape the restricted environment. The injected code executes with the full privileges of the agent process running the tool, enabling unauthorized file access, data exfiltration, or modification of the host environment.\nThe vulnerability is present in ag2 versions 0.13.2 through 1.1.1 and autogen versions 0.13.2 through 0.14.1. Authentication requirements for the agent process depend on the specific deployment context, but once the agent is under attacker influence, no further authentication is required to trigger the injection."
}