AG2 SandboxShellTool newline injection allows arbitrary command execution
Attackers can secretly run PC commands through this AI agent development tool.
Summary
In AG2 and autogen, the SandboxShellTool command check does not filter newline characters, so an attacker can add an extra statement to an agent command and run arbitrary commands. With the default LocalEnvironment backend, the injected command runs with the privileges of the agent process.
Affected when
- SandboxShellTool used with allowed=[...] or readonly=True
- Default LocalEnvironment backend
- ag2 0.13.2 or later before 1.1.1, or autogen 0.13.2 through 0.14.1
What to do
Update ag2 to 1.1.1. For autogen, versions through 0.14.1 are affected, so check that you run a newer version and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen