CVE-2026-45792: Rtk RTK Improperly Trusts Project-local Filter Vulnerability

MODERATE
Advisory Identifier: GHSA-fvvm-949w-qj4w
Share
CVSS 5.5
CWE-426 CWE-345
Published
Advisory Summary

CVE-2026-45792 is a MODERATE (CVSS 5.5) rtk improperly trusts project-local filter vulnerability (CWE-426: Untrusted Search Path) affecting Rtk libraries in the crates.io ecosystem. The issue involves rtk improperly trusts project-local filter configuration, allowing silent tampering of command output shown to llm. Remediation is available by upgrading affected packages to version 0.32.0.

CVE-2026-45792 at a Glance

CVE Identifier CVE-2026-45792
GHSA Identifier GHSA-fvvm-949w-qj4w
Severity MODERATE
CVSS v3.1 Base Score 5.5
CWE Classification CWE-426: Untrusted Search Path
Affected Product Rtk
Package Ecosystem crates.io
Published Date
Last Updated

Security Impact

CVSS: 5.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2026-45792

To remediate this vulnerability, upgrade all affected Rtk dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

rtk fixed: 0.32.0 
Upgrade rtk to 0.32.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for rtk

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-45792, inspect your project dependencies for Rtk:

inspect dependencies for rtk

Analyze the terminal output to locate any version of Rtk in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.32.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-426: Untrusted Search Path, where the product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. In Rtk, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatically loads `.rtk/filters.toml` from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., `strip_lines_matching`) to shell command output before it is shown to the LLM, without any indication that the output has been modified. This allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review. ### Patch Fixed in v0.32.0 (PRs #623, #625): - `.rtk/filters.toml` is now blocked by default when untrusted, with a visible warning: `[rtk] WARNING: untrusted project filters — Filters NOT applied. Run rtk trust to review and enable.` - SHA-256 hash verification: if the file changes after trust, filters are blocked again until re-reviewed. - New `rtk trust` / `rtk untrust` commands for explicit user consent. - Trust store implemented in `src/trust.rs`; trust gate added in `src/toml_filter.rs`.

CVE-2026-45792 Affected Rtk Versions

1 component(s)
Fixed Versions:
0.32.0
Product / Package Ecosystem Affected Versions Fixed Version
rtk
 crates.io
< 0.32.0
0.32.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/rtk-ai/rtk/security/advisories/GHSA-fvvm-949w-qj4w
NVD — CVE-2026-45792 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45792
Rtk Source Repository REPOSITORY
https://github.com/rtk-ai/rtk/pull/623
Rtk Source Repository REPOSITORY
https://github.com/rtk-ai/rtk/pull/625
Rtk Source Repository REPOSITORY
https://github.com/rtk-ai/rtk

Frequently Asked Questions

What is CVE-2026-45792?
CVE-2026-45792 is a security vulnerability in Rtk involving RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM under CWE-426: Untrusted Search Path.
Which Rtk versions are affected?
Affected versions include releases prior to 0.32.0 across affected packages: rtk.
What version fixes CVE-2026-45792?
Upgrading to 0.32.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is rtk affected?
Yes, rtk is affected in releases prior to 0.32.0. Upgrade your dependency to 0.32.0 or later.
What is the CVSS score of CVE-2026-45792?
CVE-2026-45792 has a CVSS v3.1 base score of 5.5 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N.
What CWE is associated with CVE-2026-45792?
CVE-2026-45792 is classified under CWE-426: Untrusted Search Path (The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.).
How can I check crates.io dependencies for CVE-2026-45792?
Run the dependency tree command: 'inspect dependencies for rtk'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-fvvm-949w-qj4w",
  "modified" : "2026-07-20T21:12:26Z",
  "published" : "2026-05-20T15:30:04Z",
  "aliases" : [ "CVE-2026-45792" ],
  "summary" : "RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM",
  "details" : "RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatically loads `.rtk/filters.toml` from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., `strip_lines_matching`) to shell command output before it is shown to the LLM, without any indication that the output has been modified.\n\nThis allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review.\n\n### Patch\n\nFixed in v0.32.0 (PRs #623, #625):\n\n- `.rtk/filters.toml` is now blocked by default when untrusted, with a visible warning: `[rtk] WARNING: untrusted project filters — Filters NOT applied. Run rtk trust to review and enable.`\n- SHA-256 hash verification: if the file changes after trust, filters are blocked again until re-reviewed.\n- New `rtk trust` / `rtk untrust` commands for explicit user consent.\n- Trust store implemented in `src/trust.rs`; trust gate added in `src/toml_filter.rs`.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "rtk"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.32.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/rtk-ai/rtk/security/advisories/GHSA-fvvm-949w-qj4w"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45792"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rtk-ai/rtk/pull/623"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rtk-ai/rtk/pull/625"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/rtk-ai/rtk"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-345", "CWE-426" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-20T15:30:04Z",
    "nvd_published_at" : "2026-06-23T20:16:47Z"
  }
}