CVE-2026-113663: Command Injection in AG2 Agent Framework Fixed in 1.1.1

A security advisory published on 5 November 2026 describes CVE-2026-113663, an operating system command injection vulnerability (CWE-78) in AG2, the open-source agent framework originating from the AutoGen ecosystem, distributed as the ag2 and autogen packages on PyPI. The vulnerability carries a CVSS base score of 8.8 and affects ag2 versions 0.13.2 through versions below 1.1.1, as well as autogen versions 0.13.2 through 0.14.1.

The affected SandboxShellTool component relies on a command filter to validate allowed commands when configured with an allowlist or read-only mode. The filter does not block newline or carriage-return characters, and the raw command string is passed to the shell, allowing an attacker to append arbitrary commands. On the default local execution backend, injected commands run as a host subprocess with the privileges of the agent process.

The issue is fixed in ag2 1.1.1. The advisory is listed with received status and formal analysis is pending; no active exploitation has been reported.