rtk-ai rtk

• CVE-2026-54555 High 7.8 rtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separators 0.2%
• CVE-2026-45792 Medium 6.9 RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM 0.1%
• CVE-2026-55249 Medium 6.3 @rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String 0.6%