RCE in Ag2ai Ag2
CVE-2026-113663
AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter._filter and contains_shell_operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1.
Vulnerability class: Command Injection (OS Command Injection)
Published .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Ag2ai Ag2 — versions >= 0.13.2, < 1.1.1
- Ag2ai Autogen — versions >= 0.13.2, <= 0.14.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-113663?
- CVE-2026-113663 is a high-severity vulnerability in Ag2ai Ag2, classified under OS Command Injection. CVSS score: 8.8/10. Published 2026-11-05.
- How severe is CVE-2026-113663?
- High severity. CVSS v3 base score is 8.8 out of 10.