The vulnerability is a newline injection flaw in the SandboxShellTool that bypasses the allowed command prefix validation and readonly restriction. A crafted command string containing a newline or carriage‑return allows an attacker to inject a second shell instruction that is executed by the host’s shell interpreter. This flaw exploits two weakness classes (CWE‑184: Uncontrolled Format Specifier and CWE‑78: OS Command Injection) and can compromise the confidentiality, integrity, and availability of the host system by running arbitrary commands with the same privileges as the agent process.

The flaw affects the AG2 open‑source agent platform and its Autogen component. Versions of AG2 from 0.13.2 through 1.1.1 are vulnerable, as are Autogen releases from 0.13.2 through 0.14.1. Both product families are provided by the vendor group ag2ai (AG2:ag2, Autogen:autogen). The issue was fixed in AG2 version 1.1.1 and the corresponding patched release of Autogen.

The CVSS score of 8.8 classifies the issue as high severity, indicating significant potential impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests that it may not yet be actively exploited at scale. The likely attack vector is via manipulable agent commands or configuration entries that an attacker can influence, allowing the injected newline to be processed by the underlying shell. Successful exploitation would enable the attacker to run arbitrary commands with the privileges of the agent process, potentially leading to full system compromise.