CyberSecBulletin

Rtk-ai vulnerabilities

We track 2 vulnerabilities in Rtk-ai products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on June 23, 2026.

2vulnerabilities
0critical
2high
0exploited
8.3average CVSS score

Latest Rtk-ai vulnerabilities

  • 7.8 High severity

    rtk: Incorrect Authorization

    CVE-2026-54555Rtk-ai

    rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nested execution. As a r

  • 8.8 High severity

    rtk: Improper Neutralization of Special Elements used in an OS Command

    CVE-2026-55249Rtk-ai

    @rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync() template string wit