EUVD-2026-38571Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Injected input reaches the tool remotely with no auth (PR:N) but must be forwarded by an agent/operator workflow (UI:R); shell execution yields full C/I/A within the process (S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
@rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync() template string without shell-safe escaping. JSON.stringify() wraps the value in double quotes and escapes inner double-quotes and backslashes, but leaves $() and backtick shell metacharacters untouched. Because execSync delegates execution to /bin/sh -c, the shell expands $(...) substitutions even inside double-quoted strings, causing the injected subcommand to execute before rtk is invoked. An attacker who can influence the exec tool's command parameter (e.g., via an LLM agent prompt or gateway/tool-call input) achieves arbitrary OS command execution with the privileges of the plugin/gateway process.
AnalysisAI
Arbitrary OS command execution in the @rtk-ai/rtk-rewrite 1.0.0 OpenClaw plugin allows an attacker who can influence the exec tool's command parameter - for example through an LLM agent prompt or gateway/tool-call input - to run commands with the privileges of the plugin/gateway process. The flaw stems from unsanitized input being interpolated into a shell-backed execSync() template that /bin/sh -c expands, letting $() and backtick substitutions fire before rtk runs. SSVC lists a proof-of-concept as available, though EPSS is low (0.23%, 14th percentile) and it is not in CISA KEV.
Technical ContextAI
The plugin's purpose is to transparently rewrite shell commands issued via OpenClaw's exec tool into their RTK equivalents, meaning it sits directly in the command-execution path of an AI agent tool chain. Per the CPE (cpe:2.3:a:rtk-ai:rtk) the affected component is the rtk-ai rtk package at 1.0.0. The root cause is CWE-78 (OS Command Injection): attacker-controlled input is placed into an execSync() template string, and although JSON.stringify() wraps the value in double quotes and escapes inner double-quotes and backslashes, it does not neutralize the shell metacharacters $() and backticks. Because execSync spawns /bin/sh -c, the POSIX shell performs command substitution even inside double-quoted strings, so $(...) or ... injected into the command parameter executes as a subcommand before rtk is ever invoked.
RemediationAI
Consult the vendor advisory GHSA-fqgj-m2gp-mr3q (https://github.com/rtk-ai/rtk/security/advisories/GHSA-fqgj-m2gp-mr3q) and upgrade to a fixed release once published; no exact fixed version is stated in the available data, so confirm the patched version directly from that advisory before deploying. Until a patched build is confirmed, the strongest compensating control is to stop passing untrusted or LLM-derived content into the exec tool's command parameter - treat any agent/gateway-sourced command string as hostile. As interim mitigations you can disable or unload the rtk-rewrite plugin from the OpenClaw exec pipeline (trade-off: loses the transparent RTK command rewriting), or wrap/validate the command parameter with strict allowlisting and shell-metacharacter rejection ($(), backticks, semicolons) before it reaches execSync (trade-off: may block legitimate complex commands and must be applied at the gateway, not inside the vulnerable template). Running the plugin/gateway process under a least-privilege, sandboxed account limits blast radius but does not close the injection.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today