CVE-2026-55249

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55249", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T16:44:00.625Z", "datePublished": "2026-06-23T18:33:46.014Z", "dateUpdated": "2026-06-23T18:53:41.611Z"}, "containers": {"cna": {"title": "@rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q"}], "affected": [{"vendor": "rtk-ai", "product": "rtk", "versions": [{"version": "1.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T18:33:46.014Z"}, "descriptions": [{"lang": "en", "value": "@rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync() template string without shell-safe escaping. JSON.stringify() wraps the value in double quotes and escapes inner double-quotes and backslashes, but leaves $() and backtick shell metacharacters untouched. Because execSync delegates execution to /bin/sh -c, the shell expands $(...) substitutions even inside double-quoted strings, causing the injected subcommand to execute before rtk is invoked. An attacker who can influence the exec tool's command parameter (e.g., via an LLM agent prompt or gateway/tool-call input) achieves arbitrary OS command execution with the privileges of the plugin/gateway process."}], "source": {"advisory": "GHSA-fqgj-m2gp-mr3q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T18:53:10.248142Z", "id": "CVE-2026-55249", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T18:53:41.611Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55249", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T18:53:10.248142Z"}}}], "references": [{"url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T18:53:34.218Z"}}], "cna": {"title": "@rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String", "source": {"advisory": "GHSA-fqgj-m2gp-mr3q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "rtk-ai", "product": "rtk", "versions": [{"status": "affected", "version": "1.0.0"}]}], "references": [{"url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q", "name": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "@rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync() template string without shell-safe escaping. JSON.stringify() wraps the value in double quotes and escapes inner double-quotes and backslashes, but leaves $() and backtick shell metacharacters untouched. Because execSync delegates execution to /bin/sh -c, the shell expands $(...) substitutions even inside double-quoted strings, causing the injected subcommand to execute before rtk is invoked. An attacker who can influence the exec tool's command parameter (e.g., via an LLM agent prompt or gateway/tool-call input) achieves arbitrary OS command execution with the privileges of the plugin/gateway process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T18:33:46.014Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55249", "state": "PUBLISHED", "dateUpdated": "2026-06-23T18:53:41.611Z", "dateReserved": "2026-06-16T16:44:00.625Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-23T18:33:46.014Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rtk", "vendor": "rtk-ai", "versions": [{"status": "affected", "version": "1.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rtkai:rtk-rewrite:1.0.0:*:*:*:*:rust:*:*", "matchCriteriaId": "481229B4-13AE-40B1-AC6D-DA3E3576B018", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync() template string without shell-safe escaping. JSON.stringify() wraps the value in double quotes and escapes inner double-quotes and backslashes, but leaves $() and backtick shell metacharacters untouched. Because execSync delegates execution to /bin/sh -c, the shell expands $(...) substitutions even inside double-quoted strings, causing the injected subcommand to execute before rtk is invoked. An attacker who can influence the exec tool's command parameter (e.g., via an LLM agent prompt or gateway/tool-call input) achieves arbitrary OS command execution with the privileges of the plugin/gateway process."}, {"lang": "es", "value": "@rtk-ai/rtk-rewrite reescribe de forma transparente los comandos de shell ejecutados a trav\u00e9s de la herramienta exec de OpenClaw a sus equivalentes RTK. En la versi\u00f3n 1.0.0, el plugin de OpenClaw @rtk-ai/rtk-rewrite pasa la entrada controlada por el atacante directamente a una cadena de plantilla execSync() respaldada por shell sin escape seguro para shell. JSON.stringify() envuelve el valor entre comillas dobles y escapa las comillas dobles internas y las barras invertidas, pero deja intactos los metacaracteres de shell $() y de comilla invertida. Debido a que execSync delega la ejecuci\u00f3n a /bin/sh -c, el shell expande las sustituciones $(...) incluso dentro de cadenas entre comillas dobles, lo que provoca que el subcomando inyectado se ejecute antes de que se invoque rtk. Un atacante que puede influir en el par\u00e1metro de comando de la herramienta exec (por ejemplo, a trav\u00e9s de un prompt de agente LLM o una entrada de gateway/llamada a herramienta) logra la ejecuci\u00f3n arbitraria de comandos del sistema operativo con los privilegios del proceso del plugin/gateway."}], "id": "CVE-2026-55249", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55249", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T18:53:10.248142Z", "version": "2.0.3"}}]}, "published": "2026-06-23T19:17:11.713", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.0.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "rtk", "source": "cna", "vendor": "rtk-ai"}, "product": "rtk", "vendor": "rtk-ai"}], "created": "2026-06-23T20:45:06.975495+00:00", "updated": "2026-06-24T16:05:44.749041+00:00", "vendors": ["rtk-ai", "rtk-ai$PRODUCT$rtk"]}