CVE-2026-54555 Details
Description
rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nested execution. As a result, a command beginning with an allowed prefix such as git could hide a second command behind one of these constructs. rtk rewrite returned exit code 0, causing the Claude hook to emit permissionDecision: "allow". The rewritten command still contained the hidden command, so it ran without the user confirmation or denial that the permission rules were intended to enforce. This vulnerability is fixed in 0.42.2.
A vulnerability exists in the `rtk` command-line tool, specifically in versions through 0.40.0, when used as a Claude Code `PreToolUse` hook. The issue arises because the permission splitter fails to properly parse certain shell constructs that Bash recognizes as command execution boundaries. This flaw allows a command starting with an allowed prefix, such as 'git', to conceal a second command behind these constructs. Consequently, the `rtk rewrite` command automatically approves the execution of the hidden command without requiring user confirmation, thereby bypassing the intended permission controls.
Users should update to `rtk` version 0.42.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 23, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rtk-ai/rtk | <= 0.40.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |