By vendor

Rtkai vulnerabilities

Known CVEs affecting Rtkai products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-55249MEDIUM 6.3

  @rtk-ai/rtk-rewrite is a plugin that translates shell commands into RTK-equivalent operations. Version 1.0.0 contains a command injection flaw: when the plugin processes input for shell execution, it fails to properly escape shell metacharacters like $() and backticks. An attacker who can control command input—through a prompt injection, tool-call manipulation, or similar avenue—can inject arbitrary shell commands that execute with the privileges of the plugin or gateway process. The vulnerability requires an authenticated user or external input route, but the technical bar for exploitation is low once that access exists.