Ollama Mcp
Monthly
Command injection in NightTrek Ollama-mcp (all commits through 80cf2e17) allows a local low-privileged attacker to execute arbitrary operating system commands by supplying crafted values to the name, modelfile, source, or destination arguments processed in src/index.ts. A proof-of-concept exists (CVSS 4.0 threat metric E:P), and the project maintainer has not responded to the responsible disclosure issue report filed on GitHub. No patch is available; the project operates exclusively on a rolling release model with no versioned releases.
Command injection in NightTrek Ollama-mcp (all commits through 80cf2e17) allows a local low-privileged attacker to execute arbitrary operating system commands by supplying crafted values to the name, modelfile, source, or destination arguments processed in src/index.ts. A proof-of-concept exists (CVSS 4.0 threat metric E:P), and the project maintainer has not responded to the responsible disclosure issue report filed on GitHub. No patch is available; the project operates exclusively on a rolling release model with no versioned releases.