CVE-2026-55249

creationtimestamp| type| source ---|---|--- 2026-06-23 20:49:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moybmxdeit2j 2026-07-02 08:05:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnl5nomc72l...

CVE-2026-55249

@rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync template string without shell-safe escaping. JSON.stringif...