Improper Trust in Local Configuration Files in Rust Token Killer

CVE-2026-45792

What is CVE-2026-45792?

Rust Token Killer prior to version 0.32.0 allows attackers to exploit improperly trusted project-local configuration files. An adversary can introduce a malicious .rtk/filters.toml file into a repository, enabling them to execute regex-based modifications on command outputs without user notification. This manipulation can conceal critical information such as security scan results and file contents, effectively hiding malicious code during AI-assisted development processes. Users are urged to upgrade to version 0.32.0 to mitigate this risk.

References