Command Injection Affecting autogen package, versions [0.13.2,0.14.1]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-AUTOGEN-22400857
- published10 Nov 2026
- disclosed6 Nov 2026
- creditelstati0n
Introduced: 6 Nov 2026
NewCVE-2026-113663 (opens in a new tab)How to fix?
There is no fixed version for autogen.
Overview
autogen is an A programming framework for agentic AI
Affected versions of this package are vulnerable to Command Injection via ShellAdapter._filter() in ag2/tools/sandbox/adapter/shell.py and contains_shell_operator() in ag2/tools/sandbox/filter.py, which omit newline (\n) and carriage-return (\r) characters from the set of recognized shell statement separators. When SandboxShellTool is configured with allowed=[...] or readonly=True, the filter validates only that the command starts with an allowed prefix and contains no listed shell operators, but the raw string is then passed to sh -c. Because a POSIX shell treats an embedded newline identically to a ; statement separator, an attacker-influenced agent command of the form "cat allowed_file.txt\nrm -rf /anything" passes both the prefix check and the operator check, then causes the shell to execute both statements. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the full privileges of the agent process.
Note: This is only exploitable when SandboxShellTool is configured with allowed=[...] or readonly=True.