CVE-2026-45792: RTK Information Disclosure Vulnerability

CVE-2026-45792 Overview

CVE-2026-45792 affects RTK (Rust Token Killer), a tool that filters and compresses command outputs before they reach a large language model (LLM) context. Versions prior to 0.32.0 automatically load .rtk/filters.toml from the working directory with highest priority and without notifying the user. An attacker who controls a repository can ship a malicious filter file that silently rewrites or strips shell command output before the LLM sees it. The flaw is tracked under [CWE-345: Insufficient Verification of Data Authenticity] and is fixed in version 0.32.0.

Critical Impact
Attackers can hide malicious code, diffs, and security scan results from an LLM-assisted reviewer by planting a crafted .rtk/filters.toml in a repository, undermining AI-assisted code review integrity.

Affected Products

RTK (Rust Token Killer) versions prior to 0.32.0
Developer environments using RTK to broker shell output into LLM assistants
Repositories cloned from untrusted sources where RTK is invoked locally

Discovery Timeline

2026-06-23 - CVE CVE-2026-45792 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-45792

Vulnerability Analysis

RTK acts as a filtering layer between shell commands and an LLM, removing noisy lines and compressing output to fit context windows. The tool loads configuration from multiple locations, and prior to 0.32.0 it gave the project-local .rtk/filters.toml file the highest precedence. RTK consumed this file automatically with no prompt, no signature check, and no on-screen indication that filters from an untrusted source were active. As a result, any repository could ship rules such as strip_lines_matching that suppress or rewrite specific lines of command output. A developer running cat, git diff, or a security scanner through RTK would see sanitized content while the underlying files remained malicious.

Root Cause

The root cause is improper trust of project-local configuration data, classified as [CWE-345]. RTK treated the working-directory configuration as authoritative without verifying its origin or surfacing its presence. No precedence warning, integrity check, or opt-in mechanism gated the loading of .rtk/filters.toml.

Attack Vector

Exploitation requires local execution by a user who has cloned or opened a hostile repository and then runs RTK against its contents. The attacker plants .rtk/filters.toml in the repository root with regex rules that drop or replace lines exposing backdoors, suspicious diffs, secrets, or scanner findings. When the developer pipes command output through RTK to an AI assistant such as Claude Code or Cursor, the LLM receives the censored view and approves code that contains hidden malicious logic. Authentic technical details are documented in the GitHub Security Advisory GHSA-fvvm-949w-qj4w and in GitHub Pull Request #623.

Detection Methods for CVE-2026-45792

Indicators of Compromise

Presence of an unexpected .rtk/filters.toml file in a cloned repository, especially one not referenced in project documentation.
Filter rules using strip_lines_matching or similar directives that target security-sensitive patterns such as eval, exec, base64 blobs, or scanner output.
Discrepancies between raw shell output and the output rendered into an LLM session log.

Detection Strategies

Audit repositories for .rtk/ directories before invoking RTK and review every rule the file declares.
Diff RTK-filtered output against raw command output for any file inspection, git diff, or security scan piped through RTK.
Inventory installed RTK versions across developer endpoints and flag any installation below 0.32.0.

Monitoring Recommendations

Log RTK invocations and the configuration files it loads at runtime to build an audit trail of which filters affected which sessions.
Alert on creation or modification of .rtk/filters.toml files inside source repositories tracked by your code hosting platform.
Track outbound LLM API calls from developer workstations and correlate them with RTK process activity for forensic review.

How to Mitigate CVE-2026-45792

Immediate Actions Required

Upgrade RTK to version 0.32.0 or later on every workstation and CI runner where the tool is installed.
Remove or quarantine .rtk/filters.toml files in any repository not authored by your own team until they can be reviewed.
Re-run prior AI-assisted code reviews of untrusted repositories without RTK in the pipeline to confirm no malicious code was concealed.

Patch Information

The maintainers fixed CVE-2026-45792 in RTK 0.32.0. The remediation work is documented in GitHub Pull Request #623 and GitHub Pull Request #625, with the coordinated disclosure published as GitHub Security Advisory GHSA-fvvm-949w-qj4w. The patch removes implicit trust in project-local configuration and surfaces which filter files are active.

Workarounds

Pin RTK to user-level or system-level configuration paths and avoid running RTK inside untrusted working directories until upgraded.
Manually delete any .rtk/filters.toml before invoking RTK against a freshly cloned repository.
Route security-sensitive commands such as scanner output and git diff directly to the LLM without passing through RTK during code review of third-party code.

bash

# Configuration example: upgrade and verify
cargo install rtk --version 0.32.0 --locked
rtk --version

# Audit a repository before running RTK against it
find . -path './.rtk/filters.toml' -print -exec cat {} \;