GHSA-fvvm-949w-qj4w

Source

https://github.com/advisories/GHSA-fvvm-949w-qj4w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fvvm-949w-qj4w/GHSA-fvvm-949w-qj4w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fvvm-949w-qj4w

Aliases

CVE-2026-45792

Published

2026-05-20T15:30:04Z

Modified

2026-07-20T21:30:35Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM

Details

RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatically loads .rtk/filters.toml from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., strip_lines_matching) to shell command output before it is shown to the LLM, without any indication that the output has been modified.

This allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review.

Patch

Fixed in v0.32.0 (PRs #623, #625):

.rtk/filters.toml is now blocked by default when untrusted, with a visible warning: [rtk] WARNING: untrusted project filters — Filters NOT applied. Run rtk trust to review and enable.
SHA-256 hash verification: if the file changes after trust, filters are blocked again until re-reviewed.
New rtk trust / rtk untrust commands for explicit user consent.
Trust store implemented in src/trust.rs; trust gate added in src/toml_filter.rs.

Database specific

{
    "cwe_ids":  [
        "CWE-345",
        "CWE-426"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-20T15:30:04Z",
    "nvd_published_at":  "2026-06-23T20:16:47Z",
    "severity":  "MODERATE"
}

References

Affected packages

crates.io / rtk

Package

Name: rtk; View open source insights on deps.dev
Purl: pkg:cargo/rtk

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.32.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fvvm-949w-qj4w/GHSA-fvvm-949w-qj4w.json"