Executive brief
rtk, a tool used to optimize and filter command outputs for Large Language Models (LLMs), contains a security flaw in how it validates shell commands. When used with the Claude Code interface, the tool can be tricked into automatically approving malicious commands if they are hidden behind a legitimate-looking command (like 'git'). This could allow an attacker to execute unauthorized actions, such as deleting files or stealing data, without the user's knowledge or consent.
Technical details
A vulnerability in the 'rtk rewrite' permission decision path, specifically within the permission splitter component, allows for command injection and authorization bypass. Prior to version 0.42.2, the splitter failed to recognize or conservatively handle shell constructs such as newlines (\n), background operators (&), and command substitutions ($( ) or backticks) as command boundaries. An attacker can craft a command that starts with an allowed prefix (e.g., 'git') but contains a hidden secondary command. Because rtk incorrectly returns an exit code of 0 (allow) for these combined strings, the Claude Code PreToolUse hook executes the entire malicious string without triggering the required user confirmation or denial.
Affected products
- rtk-ai rtk < 0.42.2
Timeline
- 2026-06-19: disclosed: Advisory published on GitHub
- 2026-06-23: advisory: NVD publication date
- 2026-06-23: patched: Fix confirmed in version 0.42.2