HighVulnerabilityLLM-specific
CVE-2026-54555: rtk permission splitter bypass lets hidden commands run without confirmation
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-54555
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
CVE-2026-54555 affects rtk, which filters command outputs before they reach an LLM context, in versions prior to 0.42.2. The permission splitter failed to conservatively split or reject several shell constructs that Bash treats as execution boundaries or nested execution, so a command starting with an allowed prefix such as git could conceal a second command. rtk rewrite returned exit code 0, and the Claude hook emitted permissionDecision: "allow", so the hidden command ran without the confirmation or denial the permission rules were meant to enforce.
Mitigation
Fixed in 0.42.2.
Related items
- HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
- HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database
- HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database
- MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
- MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database