The vulnerability exists in @rtk-ai/rtk-rewrite version 1.0.0, where the OpenClaw plugin uses execSync() to execute shell commands. Attacker-controlled input is wrapped with JSON.stringify(), which escapes double quotes and backslashes but does not neutralize shell metacharacters such as $() and backticks. Since execSync delegates to /bin/sh -c, these metacharacters are expanded by the shell even inside double-quoted strings, enabling command injection. An attacker able to control the exec tool's command parameter (for example, via an LLM agent prompt or gateway/tool-call input) can execute arbitrary OS commands with the plugin or gateway process privileges.

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the plugin or gateway process. This can lead to unauthorized command execution on the host system, potentially compromising confidentiality and integrity. The CVSS vector indicates network attack vector, low attack complexity, requires privileges and user interaction, with high confidentiality impact, low integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using version 1.0.0 of @rtk-ai/rtk-rewrite with untrusted input passed to the exec tool's command parameter. Restrict access to the exec tool to trusted users and inputs only. Monitor vendor channels for updates or patches addressing this vulnerability.