AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution
SandboxShellTool's restricted modes — allowed=[...] (explicit command allowlist) and readonly=True (implicit READONLY_COMMANDS allowlist) — can both be bypassed by embedding a newline character inside the command string. The filter only inspects a single-line set of shell metacharacters, but execution runs the raw string through sh -c, where a shell treats an embedded newline exactly like a ; statement separator. An agent (or content that steers the agent, e.g. via prompt injection) can therefore run arbitrary shell commands even when the tool was configured to allow only a specific command prefix or only read-only commands. With the default LocalEnvironment() backend this is a real host subprocess (its own docstring: "Commands run via subprocess on the host, so there is no real isolation"), not an isolated container, so this is full host command execution, not merely an escape from an already-sandboxed environment.
Recorded fixes — ag2: 1.1.1. Check your release branch.
Exploitation not established
| Affected range | Recorded fix |
|---|---|
| From 0.13.2 before 1.1.1Ecosystem versions | 1.1.1 |
Version evidence: OSV · GHSA-2h4w-29cv-2cmv
View original version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0.13.2"
},
{
"fixed": "1.1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.13.2",
"0.13.3",
"0.13.4",
"0.14.0",
"1.0.0",
"1.0.0b0",
"1.0.1",
"1.0.2",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.6",
"1.1.0"
]
}