CVE-2026-19334

The CVSS 5.3 on this command injection flaw in NightTrek Ollama-mcp badly understates the risk. The 'local attack required' classification assumes an attacker needs shell access to the host — but this is an MCP server designed to be invoked by AI agents. The actual threat model is: an attacker feeds a malicious prompt or jailbroken instruction to an AI agent, which passes crafted values into the 'modelfile', 'source', or 'destination' parameters. The agent acts as the delivery mechanism, not the end user. If your agent workflow trusts this server, the exploit barrier is crafting a prompt, not gaining local access. The vulnerability lives in three parameters accepting unsanitized input that gets interpolated into shell commands. Any prompt, document, or context injection that reaches an agent configured to use this MCP server can trigger command injection with the privileges that the Ollama process runs under. The compounding problem: the maintainer has gone dark and there's no patch. Worse, the rolling-release model has no version tags — you cannot audit your deployment against a vulnerable commit hash or verify you've received a fix. There's no remediation timeline, no security contact, no structured disclosure. This isn't just an unfixed vulnerability; it's orphaned infrastructure. Treat this as actively exploitable. If you're running NightTrek Ollama-mcp in any agent workflow, assume compromise until you either: (1) replace it with an alternative MCP server for Ollama that has active maintenance, or (2) implement input validation wrappers around every function call to this server that strip shell metacharacters from modelfile/source/destination arguments before they reach the server. The validation must happen at the agent orchestration layer — the server itself cannot be trusted. The CVSS rating is a red herring. This is command injection at a trust boundary component, and the AI agent delivery model makes it network-adjacent in practice even if technically local to the server process.

Reviewed through automated stages and approved by a human before publication.