GHSA-fvvm-949w-qj4w: RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM
- Identifiers
- CVE-2026-45792GHSA-fvvm-949w-qj4w
- Published
- Record updated
- Affected
- rtk < 0.32.0
- Fixed in
- 0.32.0
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.1%
Summary
RTK, a Rust tool that filters shell command output, versions before 0.32.0 automatically load `.rtk/filters.toml` from the working directory with highest priority and without notifying the user. A malicious filter file in a repository can apply regex-based changes such as `strip_lines_matching` to command output before it reaches the LLM, with no indication that the output was altered. The flaw can conceal file contents, diffs and security scan results during AI-assisted development or review.
Mitigation
Fixed in v0.32.0 (PRs #623, #625). `.rtk/filters.toml` is blocked by default when untrusted and shows a warning that filters are not applied until the user runs `rtk trust`. SHA-256 hash verification blocks the filters again if the file changes after trust. New `rtk trust` and `rtk untrust` commands provide explicit consent, with the trust store in `src/trust.rs` and the trust gate in `src/toml_filter.rs`.
Related items
- MediumCVE-2026-108759: mistral.rs sandbox escape via symlinks in mistralrs-code-execSimilar attack · NVD/CVE Database
- MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySimilar attack · NVD/CVE Database
- MediumCVE-2026-108574: BerriAI LiteLLM authorization bypass in session spend log view via session_idSimilar attack · NVD/CVE Database
- MediumCVE-2026-108670: JeecgBoot missing authorization in AiragPromptsControllerSimilar attack · NVD/CVE Database
- MediumCVE-2026-108600: open-multi-agent link following flaw in file_write tool sandboxSimilar attack · NVD/CVE Database