EUVD-2026-54871
GHSA-pq7w-6xmw-3jgj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector with low privileges required; scope is unchanged as injection is confined to the MCP server process; limited and equal CIA impact reflects restricted command execution context.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Command injection in NightTrek Ollama-mcp (all commits through 80cf2e17) allows a local low-privileged attacker to execute arbitrary operating system commands by supplying crafted values to the name, modelfile, source, or destination arguments processed in src/index.ts. A proof-of-concept exists (CVSS 4.0 threat metric E:P), and the project maintainer has not responded to the responsible disclosure issue report filed on GitHub. No patch is available; the project operates exclusively on a rolling release model with no versioned releases.
Technical ContextAI
Ollama-mcp is a Model Context Protocol (MCP) server that bridges AI orchestration clients to the Ollama local large language model runtime. The vulnerable code in src/index.ts passes user-supplied argument values - specifically name, modelfile, source, and destination - into shell command construction without adequate sanitization. CWE-77 (Improper Neutralization of Special Elements used in a Command) describes this root cause class: externally-controlled input is embedded in a command string, allowing shell metacharacters such as semicolons, backticks, or pipe symbols to alter the intended command structure. The CPE cpe:2.3:a:nighttrek:ollama-mcp:*:*:*:*:*:*:*:* confirms all tracked versions of this TypeScript package are affected. The service likely invokes Ollama CLI subcommands such as pull, push, or create using Node.js child_process APIs, and the argument values reaching those calls are not escaped or validated before execution.
RemediationAI
No vendor-released patch has been identified at time of analysis. The project maintainer was notified via GitHub issue at https://github.com/NightTrek/Ollama-mcp/issues/5 but has not responded. Organizations using ollama-mcp should immediately restrict local system access on any host running this service to only fully trusted users, preventing low-privileged or untrusted accounts from reaching the MCP server endpoints. As a primary compensating control, run ollama-mcp in an isolated container or dedicated virtual machine with a purpose-built low-privilege service account, which limits the blast radius of a successful injection to the confined environment - note that containerization does not eliminate the injection but significantly restricts lateral movement and host-level impact. Additionally, audit which arguments are passed to the service and consider wrapping invocations in a proxy that strips or rejects values containing shell metacharacters. Organizations with elevated security requirements should suspend use of this package until an upstream fix is released or the project is forked and patched internally.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today