CVE-2026-54555

rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nested execution. As a result, a command beginning with an allowed prefix such as git could hide a second command behind one of these constructs. rtk rewrite returned exit code 0, causing the Claude hook to emit permissionDecision: "allow". The rewritten command still contained the hidden command, so it ran without the user confirmation or denial that the permission rules were intended to enforce. This vulnerability is fixed in 0.42.2.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327
https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) rtk filtra y comprime las salidas de comandos antes de que lleguen a su contexto de LLM. Antes de la versión 0.42.2, el divisor de permisos no dividía ni rechazaba de forma conservadora varias construcciones de shell que Bash trata como límites de ejecución de comandos o ejecución anidada. Como resultado, un comando que comenzaba con un prefijo permitido como git podía ocultar un segundo comando detrás de una de estas construcciones. rtk rewrite devolvió el código de salida 0, lo que provocó que el hook de Claude emitiera permissionDecision: ’allow’. El comando reescrito aún contenía el comando oculto, por lo que se ejecutó sin la confirmación o denegación del usuario que las reglas de permisos estaban destinadas a aplicar. Esta vulnerabilidad está corregida en la versión 0.42.2.

Information

Published : 2026-06-23 20:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-54555

Mitre link : CVE-2026-54555

CVE.ORG link : CVE-2026-54555

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-54555", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54555", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-24T14:29:21.375030Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rtk-ai", "product": "rtk", "versions": [{"status": "affected", "version": "< 0.42.2"}]}]}], "published": "2026-06-23T20:16:49.737", "references": [{"url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327", "source": "security-advisories@github.com"}, {"url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nested execution. As a result, a command beginning with an allowed prefix such as git could hide a second command behind one of these constructs. rtk rewrite returned exit code 0, causing the Claude hook to emit permissionDecision: \"allow\". The rewritten command still contained the hidden command, so it ran without the user confirmation or denial that the permission rules were intended to enforce. This vulnerability is fixed in 0.42.2."}, {"lang": "es", "value": "rtk filtra y comprime las salidas de comandos antes de que lleguen a su contexto de LLM. Antes de la versi\u00f3n 0.42.2, el divisor de permisos no divid\u00eda ni rechazaba de forma conservadora varias construcciones de shell que Bash trata como l\u00edmites de ejecuci\u00f3n de comandos o ejecuci\u00f3n anidada. Como resultado, un comando que comenzaba con un prefijo permitido como git pod\u00eda ocultar un segundo comando detr\u00e1s de una de estas construcciones. rtk rewrite devolvi\u00f3 el c\u00f3digo de salida 0, lo que provoc\u00f3 que el hook de Claude emitiera permissionDecision: \u2019allow\u2019. El comando reescrito a\u00fan conten\u00eda el comando oculto, por lo que se ejecut\u00f3 sin la confirmaci\u00f3n o denegaci\u00f3n del usuario que las reglas de permisos estaban destinadas a aplicar. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.42.2."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}