CVE-2026-55249 Details
Description
@rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync() template string without shell-safe escaping. JSON.stringify() wraps the value in double quotes and escapes inner double-quotes and backslashes, but leaves $() and backtick shell metacharacters untouched. Because execSync delegates execution to /bin/sh -c, the shell expands $(...) substitutions even inside double-quoted strings, causing the injected subcommand to execute before rtk is invoked. An attacker who can influence the exec tool's command parameter (e.g., via an LLM agent prompt or gateway/tool-call input) achieves arbitrary OS command execution with the privileges of the plugin/gateway process.
A command injection vulnerability has been identified in the @rtk-ai/rtk-rewrite OpenClaw plugin, specifically in version 1.0.0. The vulnerability arises because the plugin passes user-controlled input directly into a shell command executed by execSync(), without proper escaping to ensure shell safety. While JSON.stringify() can escape certain characters, it does not neutralize shell metacharacters like $() and backticks. This oversight allows an attacker to inject commands that are executed by the shell before the intended command is processed, leading to arbitrary command execution on the host operating system with the same privileges as the OpenClaw plugin process.
Users are advised to update to a version of the @rtk-ai/rtk-rewrite package that addresses this vulnerability. As of now, no patched version is available.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q | CISA-ADP | ExploitPatchThird Party Advisory |
| https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q | [email protected] | ExploitPatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rtkai rtk-rewrite | 1.0.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |