AG2 code executor can write outside its working directory

What happened

AG2’s legacy code executor accepts file paths that can escape its working directory. Under the reported conditions, a crafted file can also make later code run in the agent process instead of a newly launched Docker container.

The researcher report was public on 14 July; the CVE was published on 11 October. The application must route attacker-controlled messages into the legacy executor. The Docker-marker demonstration requires permission to write at the filesystem root. The CNA gives CVSS 3.1 score 6.3. Patch status remains unconfirmed as of 11 October.