CVE-2026-55249

{
  "id": "CVE-2026-55249",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-23T19:17:11.713",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "@rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync() template string without shell-safe escaping. JSON.stringify() wraps the value in double quotes and escapes inner double-quotes and backslashes, but leaves $() and backtick shell metacharacters untouched. Because execSync delegates execution to /bin/sh -c, the shell expands $(...) substitutions even inside double-quoted strings, causing the injected subcommand to execute before rtk is invoked. An attacker who can influence the exec tool's command parameter (e.g., via an LLM agent prompt or gateway/tool-call input) achieves arbitrary OS command execution with the privileges of the plugin/gateway process."
    },
    {
      "lang": "es",
      "value": "@rtk-ai/rtk-rewrite reescribe de forma transparente los comandos de shell ejecutados a través de la herramienta exec de OpenClaw a sus equivalentes RTK. En la versión 1.0.0, el plugin de OpenClaw @rtk-ai/rtk-rewrite pasa la entrada controlada por el atacante directamente a una cadena de plantilla execSync() respaldada por shell sin escape seguro para shell. JSON.stringify() envuelve el valor entre comillas dobles y escapa las comillas dobles internas y las barras invertidas, pero deja intactos los metacaracteres de shell $() y de comilla invertida. Debido a que execSync delega la ejecución a /bin/sh -c, el shell expande las sustituciones $(...) incluso dentro de cadenas entre comillas dobles, lo que provoca que el subcomando inyectado se ejecute antes de que se invoque rtk. Un atacante que puede influir en el parámetro de comando de la herramienta exec (por ejemplo, a través de un prompt de agente LLM o una entrada de gateway/llamada a herramienta) logra la ejecución arbitraria de comandos del sistema operativo con los privilegios del proceso del plugin/gateway."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "rtk-ai",
          "product": "rtk",
          "versions": [
            {
              "version": "1.0.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 4.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T18:53:10.248142Z",
          "id": "CVE-2026-55249",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:rtkai:rtk-rewrite:1.0.0:*:*:*:*:rust:*:*",
              "matchCriteriaId": "481229B4-13AE-40B1-AC6D-DA3E3576B018"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ]
    }
  ]
}