Vulnerability-Lookup

GHSA-FVVM-949W-QJ4W

Vulnerability from github – Published: 2026-05-20 15:30 – Updated: 2026-07-20 21:12

Summary

RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM

Details

RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatically loads .rtk/filters.toml from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., strip_lines_matching) to shell command output before it is shown to the LLM, without any indication that the output has been modified.

This allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review.

Patch

Fixed in v0.32.0 (PRs #623, #625):

.rtk/filters.toml is now blocked by default when untrusted, with a visible warning: [rtk] WARNING: untrusted project filters — Filters NOT applied. Run rtk trust to review and enable.
SHA-256 hash verification: if the file changes after trust, filters are blocked again until re-reviewed.
New rtk trust / rtk untrust commands for explicit user consent.
Trust store implemented in src/trust.rs; trust gate added in src/toml_filter.rs.

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

6.9 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "rtk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.32.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45792"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345",
      "CWE-426"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-20T15:30:04Z",
    "nvd_published_at": "2026-06-23T20:16:47Z",
    "severity": "MODERATE"
  },
  "details": "RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatically loads `.rtk/filters.toml` from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., `strip_lines_matching`) to shell command output before it is shown to the LLM, without any indication that the output has been modified.\n\nThis allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review.\n\n### Patch\n\nFixed in v0.32.0 (PRs #623, #625):\n\n- `.rtk/filters.toml` is now blocked by default when untrusted, with a visible warning: `[rtk] WARNING: untrusted project filters \u2014 Filters NOT applied. Run rtk trust to review and enable.`\n- SHA-256 hash verification: if the file changes after trust, filters are blocked again until re-reviewed.\n- New `rtk trust` / `rtk untrust` commands for explicit user consent.\n- Trust store implemented in `src/trust.rs`; trust gate added in `src/toml_filter.rs`.",
  "id": "GHSA-fvvm-949w-qj4w",
  "modified": "2026-07-20T21:12:26Z",
  "published": "2026-05-20T15:30:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fvvm-949w-qj4w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45792"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rtk-ai/rtk/pull/623"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rtk-ai/rtk/pull/625"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rtk-ai/rtk"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM"
}

CVE-2026-45792 (GCVE-0-2026-45792)

Vulnerability from cvelistv5 – Published: 2026-06-23 19:02 – Updated: 2026-06-26 15:18

Title

RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM

Summary

rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.32.0, RTK (Rust Token Killer) improperly trusts project-local configuration files. RTK automatically loads .rtk/filters.toml from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., strip_lines_matching) to shell command output before it is shown to the LLM, without any indication that the output has been modified. This allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review. This vulnerability is fixed in 0.32.0.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-26 15:18 UTC

CWE

CWE-345 - Insufficient Verification of Data Authenticity
CWE-426 - Untrusted Search Path

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/rtk-ai/rtk/security/advisories…	x_refsource_CONFIRM
https://github.com/rtk-ai/rtk/pull/623	x_refsource_MISC
https://github.com/rtk-ai/rtk/pull/625	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
rtk-ai	rtk	Affected: < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45792",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T15:18:00.292179Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T15:18:22.521Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/rtk-ai/rtk/pull/623"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rtk",
          "vendor": "rtk-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.32.0, RTK (Rust Token Killer) improperly trusts project-local configuration files. RTK automatically loads .rtk/filters.toml from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., strip_lines_matching) to shell command output before it is shown to the LLM, without any indication that the output has been modified. This allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review. This vulnerability is fixed in 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426: Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-23T19:02:08.357Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fvvm-949w-qj4w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fvvm-949w-qj4w"
        },
        {
          "name": "https://github.com/rtk-ai/rtk/pull/623",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rtk-ai/rtk/pull/623"
        },
        {
          "name": "https://github.com/rtk-ai/rtk/pull/625",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rtk-ai/rtk/pull/625"
        }
      ],
      "source": {
        "advisory": "GHSA-fvvm-949w-qj4w",
        "discovery": "UNKNOWN"
      },
      "title": "RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45792",
    "datePublished": "2026-06-23T19:02:08.357Z",
    "dateReserved": "2026-05-13T08:19:32.602Z",
    "dateUpdated": "2026-06-26T15:18:22.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted