Executive brief
RTK (Rust Token Killer), a tool used to filter and compress command outputs for Large Language Models (LLMs), contains a vulnerability where it automatically trusts local configuration files. An attacker can include a malicious configuration file in a project repository that silently alters or hides command results—such as security scan warnings or malicious code—before they are sent to an AI assistant. This could lead to an AI providing unsafe advice or failing to detect security threats during development and code review.
Technical details
RTK versions prior to 0.32.0 automatically load and apply filters from `.rtk/filters.toml` located in the current working directory with high priority and no user notification. This vulnerability (CWE-345, CWE-426) allows an attacker to commit a malicious filter file to a repository that uses regex-based rules (like `strip_lines_matching`) to tamper with shell command outputs, diffs, or security tool results. Because the modifications happen silently, the LLM receives a manipulated context, potentially leading to the concealment of malicious code or vulnerabilities. The fix in version 0.32.0 introduces a trust boundary where project-local filters are skipped by default unless explicitly approved by the user via new `rtk trust` commands, verified by SHA-256 hashing.
Affected products
- rtk-ai rtk < 0.32.0
Timeline
- 2026-03-16: patched: Initial security fixes merged in PR #623 and #625
- 2026-05-20: advisory: GitHub Security Advisory GHSA-fvvm-949w-qj4w published
- 2026-06-23: disclosed: CVE-2026-45792 published to NVD