CVE-2026-55249: Command Injection in @rtk-ai/rtk-rewrite 1.0.0

Technical summary

The @rtk-ai/rtk-rewrite OpenClaw plugin constructs shell commands by embedding user input into a template string passed to execSync(). Although the code uses JSON.stringify() to wrap values in double quotes and escape internal quotes and backslashes, this escaping is insufficient. Shell metacharacters $() and backticks are left untouched and are expanded by /bin/sh -c before the rtk command is parsed. This allows command substitution within what the developer likely believed was a quoted, literal string. An attacker controlling the exec tool's command parameter—whether through LLM prompt injection, API gateway input, or tool-chain manipulation—can inject a payload like `command; malicious_command` or `$(malicious_command)` to achieve arbitrary code execution.

Business impact

Any system running the @rtk-ai/rtk-rewrite plugin (version 1.0.0) with untrusted or semi-trusted input sources is at risk of unauthorized command execution. In AI-driven workflows (LLM agents, tool gateways, orchestration platforms), this creates a path from external prompts or API calls to OS-level compromise. A successful attack could lead to data exfiltration, lateral movement, container escape, supply chain poisoning, or denial of service—depending on the attacker's objectives and the privilege level of the compromised process.

Affected systems

@rtk-ai/rtk-rewrite version 1.0.0 is the confirmed affected release. Organizations using this plugin should inventory their deployments, particularly those exposed to untrusted input (e.g., LLM-driven applications, user-submitted prompts, or public API gateways). Verify your installed version and whether your OpenClaw or tool-calling infrastructure can pass attacker-controlled input to the exec function.

Exploitability

Exploitation requires the ability to influence the exec tool's command parameter. In many AI-agent and gateway deployments, this is achievable through prompt injection or API input without authentication. Once attacker-controlled input reaches the plugin, the injection is trivial—no complex parsing or race conditions required. CVSS 6.3 (Medium) reflects the requirement for user interaction or authenticated access in some contexts; however, in open-facing LLM systems or shared tool gateways, the barrier to entry is low. This is not a network-only unauthenticated remote code execution from a standing start, but it is straightforward to exploit in realistic deployment scenarios.

Remediation

Upgrade @rtk-ai/rtk-rewrite to a patched version that properly escapes shell metacharacters. Until a patch is available, disable or restrict the exec tool to trusted internal operations only, and implement strict input validation and sandboxing for any user-controllable data that could reach the command parameter. If the plugin is part of an LLM agent or gateway, apply prompt guards and input filtering to prevent injection payloads from reaching the exec function. Consider running the plugin in a restricted container or sandbox with minimal OS capabilities.

Patch guidance

Check the @rtk-ai/rtk-rewrite project repository or vendor advisory for patched versions. The fix should replace JSON.stringify() escaping with proper shell-aware escaping (e.g., using libraries like `shell-escape` or `shlex.quote` equivalents) to neutralize $(), backticks, and other shell metacharacters. Verify the patch version in the vendor's release notes before deploying to production. After patching, test command-execution workflows with sample payloads containing shell metacharacters to confirm the fix is effective.

Detection guidance

Look for instances of @rtk-ai/rtk-rewrite 1.0.0 in package.json, lock files, and container images. Monitor execSync() or subprocess execution logs for suspicious command patterns, especially those containing $() or backticks in arguments. Inspect LLM prompt logs and API gateway access logs for injection-like payloads (e.g., commands embedded in user input). If your plugin is exposed via tool-calling interfaces, correlate exec tool invocations with external or untrusted input sources. Check process execution telemetry for unexpected child processes spawned from the plugin's context.

Why prioritize this

Although rated MEDIUM, this vulnerability warrants prompt attention in AI-heavy deployments where LLM agents or public gateways can influence exec inputs. The technical simplicity of exploitation combined with the high business impact of OS command execution justifies treating this as a near-critical issue if your infrastructure is exposed. Organizations with closed, trust-boundary-respecting tool access can defer patching slightly longer, but public-facing or prompt-injectable scenarios should be patched immediately.

Risk score, explained

CVSS 6.3 reflects (i) network-accessible exploitation vector, (ii) low attack complexity—no special conditions or tools needed—(iii) requirement for low privilege (authenticated user or trusted input channel) in the CVSS model, (iv) no scope change, and (v) high confidentiality impact (arbitrary command execution can read sensitive data) but lower impact on integrity and availability in this particular vector. In real-world AI and gateway contexts, you should mentally elevate this to 8+, as the 'low privilege' requirement is often moot when the tool is exposed to untrusted LLM prompts or API calls.

Frequently asked questions