Ollama
CVE-2025-15063
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8, EPSS 1.0%. Ollama is a popular local LLM runner. Compromising its MCP server gives access to AI model data and the host system. |
| Exploit ScenarioDerived | An attacker sends crafted MCP messages to the Ollama MCP Server that inject OS commands through execAsync, gaining shell access on the machine running local LLMs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Ollama MCP Server has a command injection vulnerability in execAsync (EPSS 1.0%) allowing remote attackers to execute arbitrary commands on systems running the Ollama AI integration.
Earlier versions of this analysis (1)
Command injection in Ollama MCP Server enables RCE on AI development machines.
RemediationAI
Update the MCP server. Bind to localhost only. Sanitize all command inputs.
Affected ProductsAI
Ollama MCP Server
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Ollama MCP Server has a CWE-78 command injection in the execAsync function that allows remote command execution through crafted MCP protocol messages.
Know when Ollama gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ollama MCP Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27683.
Executive ViewAI
CVE-2025-15063 is a critical remote code execution vulnerability in Ollama MCP Server with a 9.8 CVSS score that allows unauthenticated attackers to execute arbitrary commands. Organizations using Ollama MCP Server face immediate risk of system compromise, data breach, and operational disruption. No vendor patch is currently available, requiring urgent mitigation measures.
Network segmentation: restrict Ollama MCP Server access to trusted internal IPs only via firewall rules. Disable execAsync command functionality if supported by configuration. Deploy Web Application Firewall (WAF) rules to detect and block command injection patterns. Implement strict input validation and sanitization at application layer. Enable comprehensive logging and SIEM alerting for suspicious activity. Run affected services with minimal privileges. Disable Ollama MCP Server if operationally feasible until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path,
Remote code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) lets an attacker who can influence HTTP up
Silent auto-update code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) stems from an update-verificat
Remote denial of service in Ollama (HEAD f0078ae) allows unauthenticated attackers to crash the entire server by uploadi
Denial of service in Ollama's multi-modal image processing (versions 0.11.5-rc0 through 0.13.5) lets remote attackers cr
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 8.2), this vulnerability is remotely exploita
A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by
Information disclosure in Ollama's model quantization engine (confirmed affected in v0.13.5) allows remote, unauthentica
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function rea
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder [CVSS 7.5 HIGH]
A divide by zero vulnerability exists in ollama/ollama version v0.3.3. Rated high severity (CVSS 7.5), this vulnerabilit
GitHub PoC
Exploit-DB