Fix: Block Shell tool regex denylist bypass leading to command injection (CVE-2026-2256)

ms_agent/tools/code/code_executor.py

@@ -407,8 +407,10 @@ async def _get_tools_inner(self) -> Dict[str, Any]:
                     tool_name='shell_executor',
                     server_name='code_executor',
                     description=
-                    ('Execute shell commands in an isolated environment using bash. '
-                     'Supports basic shell operations like ls, cd, mkdir, rm, etc. '
+                    ('Execute one shell command in an isolated environment. '
+                     'Commands will be executed directly without shell parsing. '
+                     'For shell syntax (cd, &&, ||, pipes, redirection), use explicit wrapper like sh -lc "...". '
+                     'Supports basic operations like ls, mkdir, rm, mv, npm, pip, etc. '
                      'Data files in the output directory are accessible at /data/ path. '
                      ),
                     parameters={
@@ -421,7 +423,7 @@ async def _get_tools_inner(self) -> Dict[str, Any]:
                             'timeout': {
                                 'type': 'integer',
                                 'description': 'Execution timeout in seconds',
-                                'default': 30
+                                'default': 900
                             }
                         },
                         'required': ['command'],
@@ -648,13 +650,22 @@ async def shell_executor(self,
         try:
             logger.info(f'Executing command: {command[:50]}...')
 
+            shell_meta = ('&&', '||', '|', ';', '>', '<', '`', '$(', 'cd ',
+                          'export ')
+            already_wrapped = command.lstrip().startswith(
+                ('sh ', 'bash ', '/bin/sh ', '/bin/bash '))
+            if not already_wrapped and any(meta in command
+                                           for meta in shell_meta):
+                import shlex
+                command = f'sh -lc {shlex.quote(command)}'
+
             # Execute via shell_executor
             result = await self.manager.execute_tool(
                 sandbox_id=self.sandbox_id,
                 tool_name='shell_executor',
                 parameters={
                     'command': command,
-                    'timeout': timeout or 60
+                    'timeout': timeout or 900
                 })
             success = result.status == ExecutionStatus.SUCCESS
 

ms_agent/tools/tool_manager.py

@@ -18,7 +18,6 @@
 from ms_agent.tools.image_generator import ImageGenerator
 from ms_agent.tools.mcp_client import MCPClient
 from ms_agent.tools.search.websearch_tool import WebSearchTool
-from ms_agent.tools.shell.shell import Shell
 from ms_agent.tools.split_task import SplitTask
 from ms_agent.tools.todolist_tool import TodoListTool
 from ms_agent.tools.video_generator import VideoGenerator
@@ -56,8 +55,6 @@ def __init__(self,
         if hasattr(config, 'tools') and hasattr(config.tools,
                                                 'video_generator'):
             self.extra_tools.append(VideoGenerator(config))
-        if hasattr(config, 'tools') and hasattr(config.tools, 'shell'):
-            self.extra_tools.append(Shell(config))
         if hasattr(config, 'tools') and hasattr(config.tools, 'file_system'):
             self.extra_tools.append(
                 FileSystemTool(

projects/code_genesis/README.md

@@ -19,25 +19,16 @@ This project needs to be used together with ms-agent.
   cd ms-agent
   ```
 
-2. Prepare python environment (python>=3.10) with conda:
+2. Build the Docker sandbox image (requires Docker):
 
   ```shell
-  conda create -n code_genesis python==3.11
-  conda activate code_genesis
-  pip install -r ./requirements.txt
+  bash projects/code_genesis/tools/build_sandbox_image.sh
   ```
 
-3. Prepare npm environment, following https://nodejs.org/en/download. If you are using Mac, using Homebrew is recommended: https://formulae.brew.sh/formula/node
+  This builds a `code-genesis-sandbox:version1` image containing Python 3.12, Node.js 20, npm, git and curl. All shell commands from the agents run inside this container for security isolation.
+  Note: To speed up dependency downloads during image builds and at container runtime, we use some mirror registries instead of the official sources by default. If your network environment does not require mirrors, you can comment out the relevant lines.
 
-Make sure your installation is successful:
-
-```shell
-npm --version
-```
-
-Make sure the npm installation is successful, or the npm install/build/dev will fail and cause an infinite loop.
-
-4. Run:
+3. Run:
 
 ```shell
 PYTHONPATH=. openai_api_key=your-api-key openai_base_url=your-api-url python ms_agent/cli/cli.py run --config projects/code_genesis --query 'make a demo website' --trust_remote_code true

projects/code_genesis/coding.yaml

@@ -103,11 +103,10 @@ prompt:
     8. When fixing issues and updating files:
     Call the `edit_file` tool or `write_file` tool, after fixing issues there's no need to check by yourself, the lsp tool will check and report issues.
 
-    9. You can use the shell to debug problems:
+    9. You can use the shell_executor to debug problems:
 
     Example:
-    # Find all fields of a class
-    execute_single(command='python -c "from module import MyClass; print(vars(MyClass))"')
+    shell_executor(command='python -c "from module import MyClass; print(vars(MyClass))"')
 
     Your optimization goals:
     1. [Priority] Output the most accurate code implementation at once, without hallucinations or incorrect references.
@@ -128,8 +127,25 @@ tools:
       base_url: https://api.morphllm.com/v1
   plugins:
     - workflow/api_search
-  shell:
+  code_executor:
     mcp: false
+    sandbox:
+      mode: local
+      type: docker_notebook
+      image: code-genesis-sandbox:version1
+      working_dir: /data
+      timeout: 180
+      memory_limit: "2g"
+      cpu_limit: 2.0
+      network_enabled: true
+      tools_config:
+        shell_executor: {}
+    exclude:
+      - notebook_executor
+      - python_executor
+      - file_operation
+      - reset_executor
+      - get_executor_info
 
 pre_import_check: true
 post_import_check: true

projects/code_genesis/install.yaml

@@ -34,7 +34,7 @@ prompt:
       - Avoid installing development tools (like eslint, prettier) unless they are essential for the project to function
       - If the framework description states "No Framework" or "No external dependencies", do NOT create or install unnecessary dependencies
 
-    2. After writing dependency files (if needed), you should proactively call shell tools to install dependencies ONLY if:
+    2. After writing dependency files (if needed), you should proactively call the shell_executor tool to install dependencies ONLY if:
       - The project has runtime dependencies that are required for execution
       - The project explicitly requires build tools or package managers
       - Do NOT install dependencies for simple vanilla web projects that can run without them
@@ -46,17 +46,33 @@ prompt:
 
 max_chat_round: 20
 
+tool_call_timeout: 30000
+
 tools:
-  shell:
+  code_executor:
     mcp: false
-    timeout: 180
+    sandbox:
+      mode: local
+      type: docker_notebook
+      image: code-genesis-sandbox:version1
+      working_dir: /data
+      timeout: 180
+      memory_limit: "2g"
+      cpu_limit: 2.0
+      network_enabled: true
+      tools_config:
+        shell_executor: {}
+    exclude:
+      - notebook_executor
+      - python_executor
+      - file_operation
+      - reset_executor
+      - get_executor_info
 
   file_system:
     mcp: false
     include:
       - read_file
       - write_file
 
-tool_call_timeout: 120
-
 help: |