CVE-2026-54555: rtk Command Injection RCE Vulnerability

CVE-2026-54555 Overview

CVE-2026-54555 is an authorization bypass vulnerability [CWE-863] in rtk, a tool that filters and compresses command outputs before they reach large language model (LLM) context windows. The flaw resides in the permission splitter component, which fails to conservatively split or reject shell constructs that Bash treats as command execution boundaries. An attacker can craft a command that begins with an allowed prefix such as git but hides a second command behind a nested execution construct. The rtk rewrite operation returns exit code 0, causing the Claude hook to emit permissionDecision: "allow" and execute the hidden command without user confirmation. Versions prior to 0.42.2 are affected.

Critical Impact
Attackers who control prompt input to an LLM agent using rtk can execute arbitrary shell commands that bypass the permission allowlist, leading to full local code execution under the user's privileges.

Affected Products

rtk versions prior to 0.42.2
Claude agent integrations relying on rtk permission hooks
LLM workflow environments using rtk for command rewriting and permission decisions

Discovery Timeline

2026-06-23 - CVE-2026-54555 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-54555

Vulnerability Analysis

The vulnerability stems from incomplete parsing of Bash command syntax inside the rtk permission splitter. The splitter inspects incoming commands and decides whether each segment matches an allowlisted prefix such as git. When it encounters certain shell constructs that Bash interprets as new execution boundaries or nested execution, the splitter does not reject the command or split it into independent segments. The first segment matches an allowed prefix, so the entire input is treated as permitted.

Because rtk rewrite exits successfully, the Claude hook receives permissionDecision: "allow" and forwards the rewritten command to the shell. The hidden command executes alongside the allowed one, bypassing the user confirmation step that the permission rules were intended to enforce. This is a classic authorization bypass through parser differential between rtk and the downstream Bash interpreter.

Root Cause

The root cause is an incomplete shell grammar implementation in the permission splitter. Bash recognizes many constructs as command separators or nested execution contexts, including command substitution, process substitution, subshells, and conditional execution operators. The pre-0.42.2 splitter did not enumerate all such constructs, leaving a gap between what rtk authorized and what Bash actually executed.

Attack Vector

Exploitation requires local execution context and user interaction with an LLM agent that uses rtk. An attacker who can influence the prompt or tool input submitted to the agent supplies a command that opens with an allowed prefix and chains a hidden payload through an unhandled shell construct. The vector aligns with the CVSS metrics indicating local attack vector with required user interaction. Successful exploitation yields arbitrary command execution at the privilege level of the user running the agent, compromising confidentiality, integrity, and availability of the host.

No public proof-of-concept exploit is listed in the NVD references. The vendor security advisory at GitHub Security Advisory GHSA-7gxq-fvfc-g327 describes the affected constructs.

Detection Methods for CVE-2026-54555

Indicators of Compromise

Shell process trees where a git or other allowlisted parent invokes unrelated binaries such as curl, wget, bash -c, or sh -c.
Audit log entries showing rtk rewrite exit code 0 followed by execution of commands that were not surfaced for user confirmation.
Outbound network connections initiated by child processes of Claude agent or rtk host processes to unexpected destinations.

Detection Strategies

Monitor command-line telemetry for shell metacharacters such as $(), backticks, ;, &&, ||, and <() inside arguments passed to LLM agents.
Correlate rtk permission decisions with the actual command strings executed downstream to detect parser differentials.
Alert on agent-initiated execution of interpreters like bash, sh, python, or node when the parent command appears to be a benign tool such as git.

Monitoring Recommendations

Enable verbose logging on rtk and capture both the original prompt and the rewritten command for offline review.
Forward host process creation events to a centralized log store and retain at least 30 days of agent-initiated executions.
Periodically audit allowlist rules and test them against known shell injection patterns to confirm coverage.

How to Mitigate CVE-2026-54555

Immediate Actions Required

Upgrade rtk to version 0.42.2 or later on every system where the tool is installed.
Inventory all Claude hook integrations and confirm they reference the patched rtk binary.
Review recent agent execution logs for shell constructs that may indicate prior exploitation attempts.

Patch Information

The maintainers fixed the vulnerability in rtk version 0.42.2. Details are available in the rtk GitHub Security Advisory GHSA-7gxq-fvfc-g327. Apply the upgrade through your standard package manager or by pulling the patched release from the project repository.

Workarounds

Restrict the rtk allowlist to commands that do not accept arbitrary user-controlled arguments until the patch is deployed.
Disable the Claude permission hook integration on hosts where upgrading is not immediately possible.
Run the LLM agent under an unprivileged service account with minimal filesystem and network access to limit blast radius.

bash

# Configuration example: verify rtk version before allowing agent startup
rtk --version | awk '{print $NF}' | \
  awk -F. '{ if (($1*10000 + $2*100 + $3) < 4202) exit 1 }' \
  || { echo "rtk < 0.42.2 detected, refusing to start agent"; exit 1; }