RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM

Vulnerability

RTK (Rust Token Killer) versions prior to 0.32.0 automatically load .rtk/filters.toml from the working directory with the highest priority and without user notification. This file can define regex-based modifications (e.g., strip_lines_matching) that are applied to shell command output before it is sent to the LLM. The trust boundary is improperly enforced, allowing an attacker to place a malicious filter file in a repository [1][3].

Exploitation

An attacker creates a repository containing a crafted .rtk/filters.toml file. When a victim runs RTK in that repository, the malicious filters are silently loaded and applied to all command outputs. No special network position or authentication is required — only that the victim executes RTK within the affected directory [2][3].

Impact

Successful exploitation allows the attacker to selectively suppress or alter command output, including file contents, diffs, and security scan results, without any indication that the output has been modified. This can conceal malicious code during AI-assisted development or code review, potentially leading to supply-chain compromise [3].

Mitigation

The vulnerability is fixed in RTK v0.32.0 (PRs #623, #625). The fix introduces a trust boundary: untrusted project-local filters are blocked by default with a warning message, SHA-256 hash verification ensures that changes to the file after trust are detected, and new rtk trust / rtk untrust commands provide explicit user consent [2][4]. Users should upgrade to v0.32.0 or later.