The flaw resides in the command rewriting logic of rtk, which omits splitting or rejecting several shell constructs that Bash treats as command execution boundaries. This allows a user‑supplied command that starts with a permitted keyword such as git to conceal a hidden command behind constructs like backticks or nested execution. The rewrite component returned a zero exit code, causing the system to automatically grant permission and execute the concealed command. The effect is a bypass of the permission guard, enabling arbitrary command execution without user confirmation.

Any installation of the rtk product from the rtk‑ai vendor running a version older than 0.42.2 is vulnerable. The affected component is the rewrite module responsible for generating LLM context from user commands.

The CVSS score of 7.8 indicates moderate‑to‑high severity, and while the EPSS score is not available, the absence from the KEV catalog suggests no widespread exploitation yet. Nevertheless, an attacker who can supply commands to the rtk LLM interface can trigger this flaw, achieving privilege escalation on the host running rtk. The attack vector is inferred to be remote or local command input to the rewrite service.