CVE-2026-54555

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54555", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T19:04:14.456Z", "datePublished": "2026-06-23T19:05:20.849Z", "dateUpdated": "2026-06-24T14:30:40.984Z"}, "containers": {"cna": {"title": "rtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separators", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327"}], "affected": [{"vendor": "rtk-ai", "product": "rtk", "versions": [{"version": "< 0.42.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T19:05:20.849Z"}, "descriptions": [{"lang": "en", "value": "rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nested execution. As a result, a command beginning with an allowed prefix such as git could hide a second command behind one of these constructs. rtk rewrite returned exit code 0, causing the Claude hook to emit permissionDecision: \"allow\". The rewritten command still contained the hidden command, so it ran without the user confirmation or denial that the permission rules were intended to enforce. This vulnerability is fixed in 0.42.2."}], "source": {"advisory": "GHSA-7gxq-fvfc-g327", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-24T14:29:21.375030Z", "id": "CVE-2026-54555", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T14:30:40.984Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54555", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-24T14:29:21.375030Z"}}}], "references": [{"url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-24T14:30:32.307Z"}}], "cna": {"title": "rtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separators", "source": {"advisory": "GHSA-7gxq-fvfc-g327", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "rtk-ai", "product": "rtk", "versions": [{"status": "affected", "version": "< 0.42.2"}]}], "references": [{"url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327", "name": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nested execution. As a result, a command beginning with an allowed prefix such as git could hide a second command behind one of these constructs. rtk rewrite returned exit code 0, causing the Claude hook to emit permissionDecision: \"allow\". The rewritten command still contained the hidden command, so it ran without the user confirmation or denial that the permission rules were intended to enforce. This vulnerability is fixed in 0.42.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T19:05:20.849Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54555", "state": "PUBLISHED", "dateUpdated": "2026-06-24T14:30:40.984Z", "dateReserved": "2026-06-15T19:04:14.456Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-23T19:05:20.849Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rtk", "vendor": "rtk-ai", "versions": [{"status": "affected", "version": "< 0.42.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nested execution. As a result, a command beginning with an allowed prefix such as git could hide a second command behind one of these constructs. rtk rewrite returned exit code 0, causing the Claude hook to emit permissionDecision: \"allow\". The rewritten command still contained the hidden command, so it ran without the user confirmation or denial that the permission rules were intended to enforce. This vulnerability is fixed in 0.42.2."}, {"lang": "es", "value": "rtk filtra y comprime las salidas de comandos antes de que lleguen a su contexto de LLM. Antes de la versi\u00f3n 0.42.2, el divisor de permisos no divid\u00eda ni rechazaba de forma conservadora varias construcciones de shell que Bash trata como l\u00edmites de ejecuci\u00f3n de comandos o ejecuci\u00f3n anidada. Como resultado, un comando que comenzaba con un prefijo permitido como git pod\u00eda ocultar un segundo comando detr\u00e1s de una de estas construcciones. rtk rewrite devolvi\u00f3 el c\u00f3digo de salida 0, lo que provoc\u00f3 que el hook de Claude emitiera permissionDecision: \u2019allow\u2019. El comando reescrito a\u00fan conten\u00eda el comando oculto, por lo que se ejecut\u00f3 sin la confirmaci\u00f3n o denegaci\u00f3n del usuario que las reglas de permisos estaban destinadas a aplicar. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.42.2."}], "id": "CVE-2026-54555", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54555", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-24T14:29:21.375030Z", "version": "2.0.3"}}]}, "published": "2026-06-23T20:16:49.737", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.42.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "rtk", "source": "cna", "vendor": "rtk-ai"}, "product": "rtk", "vendor": "rtk-ai"}], "created": "2026-06-23T20:45:06.974387+00:00", "updated": "2026-06-24T16:05:42.410090+00:00", "vendors": ["rtk-ai", "rtk-ai$PRODUCT$rtk"]}