Description

A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-09T05:16:51.397Z",
  "pubdate": "2026-08-09T05:16:51.397Z",
  "executiveSummary": "A command injection vulnerability has been identified in the NightTrek Ollama-mcp project, specifically affecting the source code up to commit 80cf2e17cfc144963a475b619093a2d13c13dbc9. The flaw resides within an unknown component inside the src/index.ts file. This security defect stems from the insecure handling of input parameters—specifically the name, modelfile, source, and destination arguments—which are insufficiently sanitized or escaped before being passed to underlying operating system execution sinks.\nSuccessful exploitation of this vulnerability allows a local attacker to execute arbitrary system commands with the privileges of the running application process. Given that the software utilizes a rolling release model without explicit version tagging, all deployments pulling code up to the specified commit hash remain vulnerable. The primary risk implication includes local system compromise, arbitrary code execution, and potential data exfiltration or tampering depending on the privilege level of the host process. The attack vector is restricted to local execution capabilities, meaning the threat actor must already possess local access or the ability to manipulate input vectors locally to leverage the flaw.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw located in the src/index.ts file of the NightTrek Ollama-mcp repository. The root cause of the vulnerability lies in the insecure parameter handling where user-supplied or externally influenced arguments—specifically name, modelfile, source, and destination—are concatenated or passed directly into system shell invocation functions, such as child_process.exec or similar command execution primitives, without proper input sanitization, validation, or escaping.\nThe attack flow proceeds as follows: First, an attacker supplies malicious input containing operating system command separators (such as semicolons, ampersands, or pipe characters) combined with payload commands into one of the vulnerable arguments: name, modelfile, source, or destination. Second, the application processes the input through src/index.ts and constructs a dynamic command string intended for execution on the host operating system. Third, because the input is inadequately sanitized, the underlying shell interprets the attacker-controlled characters as command delimiters, terminating the intended application command and executing the injected payload.\nRegarding execution requirements, the vulnerability requires local access to execute the attack, as indicated by the threat profile. Authentication and privilege requirements depend on the local execution context of the Ollama-mcp instance, but exploitation generally inherits the permissions assigned to the running Node.js process. Because the application processes inputs related to model management and file operations (name, modelfile, source, destination), any interface exposing these parameters to local manipulation serves as the entry point for payload delivery.\nPost-exploitation impact includes full code execution within the context of the user running the NightTrek Ollama-mcp service. This may enable an attacker to read sensitive files, install persistent backdoors, pivot to other local services, or disrupt host operations. No official vendor patch or updated release version details are currently available due to the rolling release nature of the product and the lack of vendor response to early disclosures."
}