rtk vulnerabilities

2 known vulnerabilities in rtk from Rtk-ai. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  rtk: Incorrect Authorization

  CVE-2026-54555Jun 23, 2026Rtk-ai

  rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nested execution. As a r

• 8.8 High severity

  rtk: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-55249Jun 23, 2026Rtk-ai

  @rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync() template string wit