Command Injection Vulnerability in NightTrek's Ollama-mcp Software
CVE-2026-19334

4.8MEDIUM

Key Information:

Vendor

Nighttrek

Status
Ollama-mcp
Vendor
CVE Published:
9 August 2026

What is CVE-2026-19334?

A vulnerability exists in NightTrek's Ollama-mcp software that allows for command injection through manipulation of specific argument names including modelfile, source, and destination. This flaw can be exploited locally, potentially allowing an attacker to run arbitrary commands on the affected system. Despite the issue being reported to the development team, there has been no response or remediation, leaving users at risk given the product's rolling release nature, which complicates the tracking of affected and updated versions.

Affected Version(s)

Ollama-mcp 80cf2e17cfc144963a475b619093a2d13c13dbc9

References

https://vuldb.com/vuln/387170
vdb-entrytechnical-description
https://vuldb.com/vuln/387170/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19334
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

gongyanyu04 (VulDB User)
VulDB CNA Team
.