CVE-2026-113663: SandboxShellTool newline injection bypasses allowlist, enabling arbitrary command execution

# CVE-2026-113663: SandboxShellTool newline injection bypasses allowlist, enabling arbitrary command execution

https://gcdradar.vercel.app/incidents/cve-2026-113663-sandboxshelltool-newline-injection-bypasses · AIR-2026-1857 · closed 2026-11-10

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Disclosed vulnerability with CVE, no confirmed exploitation.
- Fix status: Fix status unknown
- First reported: 2026-11-10
- AI role: Attack on AI
- Products: SandboxShellTool
- CVE ids: CVE-2026-113663
- CVSS: 8.8

## Summary

A newline injection flaw in SandboxShellTool's allowed and readonly modes lets an attacker embed a newline to break the command filter and execute arbitrary shell commands via sh -c. The vulnerability is tracked as CVE‑2026‑113663 and currently has no known exploitation.

## What to do

Avoid using untrusted input with SandboxShellTool and monitor for a patched release.

## Affected and fixed versions

- Affected: ag2 >= 0.13.2, < 1.1.1
- Affected: autogen >= 0.13.2, <= 0.14.1
- Fixed in: ag2 1.1.1

## Latest updates

- 2026-11-10: CVE-2026-113663: AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution (https://github.com/advisories/GHSA-2h4w-29cv-2cmv)

## Sources

- 2026-11-10 GitHub Advisory Database: CVE-2026-113663: AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution https://github.com/advisories/GHSA-2h4w-29cv-2cmv

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.