GHSA-2H4W-29CV-2CMV AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

Summary SandboxShellTool's restricted modes — allowed=... explicit command allowlist and readonly=True implicit READONLYCOMMANDS allowlist — can both be bypassed by embedding a newline character inside the command string. The filter only inspects a single-line set of shell metacharacters, but...

EUVD-2026-117877

AG2: Newline injection in SandboxShellTool bypasses allowed=... and readonly=True, enabling arbitrary command execution...

AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

Summary SandboxShellTool's restricted modes — allowed=... explicit command allowlist and readonly=True implicit READONLYCOMMANDS allowlist — can both be bypassed by embedding a newline character inside the command string. The filter only inspects a single-line set of shell metacharacters, but...

CVE-2026-108543

A flaw was found in ag2. The UserProxyAgent component fails to properly validate the filename parameter, resulting in a path traversal vulnerability. A remote attacker could exploit this flaw by providing a crafted filename, potentially allowing unauthorized access to files outside the intended...

CVE-2026-113663

A flaw was found in AG2. The sandbox shell filtering mechanism fails to properly sanitize newline and carriage-return line break characters in command inputs. An attacker capable of influencing agent commands can exploit this flaw to inject and execute arbitrary commands on the host system with t...

CVE-2026-113663

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=... or readonly=True rely on ShellAdapter.filter and containsshelloperator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate...

CVE-2026-113663

The AG2 open-source AgentOS contains a vulnerability in SandboxShellTool configurations (versions 0.13.2 until 1.1.1; autogen 0.13.2 to 0.14.1) when using allowed=[...] or readonly=True. The ShellAdapter._filter and contains_shell_operator functions in ag2/tools/sandbox/filter.py and ag2/tools/sa...

CVE-2026-113663

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=... or readonly=True rely on ShellAdapter.filter and containsshelloperator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate...

CVE-2026-113663 AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=... or readonly=True rely on ShellAdapter.filter and containsshelloperator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate...

CVE-2026-113663 AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=... or readonly=True rely on ShellAdapter.filter and containsshelloperator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate...

CVE-2026-113663: ag2ai: AG2 is an open-source AgentOS

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=... or readonly=True rely on ShellAdapter.filter and containsshelloperator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate...

PT-2026-137757

AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=... or readonly=True rely on ShellAdapter. filter and contains shell operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to...

Directory Traversal

Overview ag2 is an A programming framework for agentic AI Affected versions of this package are vulnerable to Directory Traversal via the os.path.join function in the UserProxyAgent component. An attacker can access or modify files outside the intended directory by supplying crafted input as the...

CVE-2026-108543

A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclos...

CVE-2026-108543

The ag2ai ag2 library (versions up to 0.13.4 ) is vulnerable to a path traversal vulnerability within the UserProxyAgent component. The root cause is the improper handling of the filename argument in the os.path.join function, which allows for remote execution of the attack. While an exploit has ...

EUVD-2026-96864

A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclos...

CVE-2026-108543

A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclos...

CVE-2026-108543 ag2ai ag2 UserProxyAgent os.path.join path traversal

A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclos...

PT-2026-110073

Name of the Vulnerable Software and Affected Versions ag2ai ag2 versions prior to 0.13.5 Description A path traversal issue exists in the UserProxyAgent component. The problem occurs within the os.path.join function when processing the filename argument, allowing a remote attacker to manipulate...

ag2.kku.ac.th Cross Site Scripting vulnerability OBB-3855490

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...