CVE-2026-19334: Command Injection in NightTrek Ollama-mcp
CVE-2026-19334 is a command injection vulnerability in NightTrek Ollama-mcp affecting an unknown part of the file src/index.ts. The vulnerability arises from manipulation of arguments such as name, modelfile, source, or destination. Exploitation requires local access to the system. The product uses a rolling release model, so specific affected or fixed versions are not available. The vendor has been informed but has not yet responded or provided a fix.
AI Analysis
Technical Summary
This vulnerability in NightTrek Ollama-mcp up to commit 80cf2e17cfc144963a475b619093a2d13c13dbc9 allows local attackers to perform command injection by manipulating certain arguments (name, modelfile, source, destination) in the src/index.ts file. Due to the rolling release nature of the product, no explicit version numbers are provided for affected or patched releases. The issue was reported early to the project, but no vendor response or remediation has been published.
Potential Impact
An attacker with local access can exploit this vulnerability to execute arbitrary commands on the affected system. The impact is limited by the requirement for local access and the absence of user interaction. The CVSS score of 4.8 reflects a medium severity level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should restrict local access to trusted users only and monitor for updates from the vendor regarding a patch or mitigation.
CVE-2026-19334: Command Injection in NightTrek Ollama-mcp
Description
CVE-2026-19334 is a command injection vulnerability in NightTrek Ollama-mcp affecting an unknown part of the file src/index.ts. The vulnerability arises from manipulation of arguments such as name, modelfile, source, or destination. Exploitation requires local access to the system. The product uses a rolling release model, so specific affected or fixed versions are not available. The vendor has been informed but has not yet responded or provided a fix.
CVSS v4.0
Score 4.8medium
Affected software
cpe:2.3:a:nighttrek:ollama-mcp:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in NightTrek Ollama-mcp up to commit 80cf2e17cfc144963a475b619093a2d13c13dbc9 allows local attackers to perform command injection by manipulating certain arguments (name, modelfile, source, destination) in the src/index.ts file. Due to the rolling release nature of the product, no explicit version numbers are provided for affected or patched releases. The issue was reported early to the project, but no vendor response or remediation has been published.
Potential Impact
An attacker with local access can exploit this vulnerability to execute arbitrary commands on the affected system. The impact is limited by the requirement for local access and the absence of user interaction. The CVSS score of 4.8 reflects a medium severity level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should restrict local access to trusted users only and monitor for updates from the vendor regarding a patch or mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-08T09:55:28.464Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a780c13bf8831d5390bcc7a
Added to database: 08/09/2026, 05:11:47 UTC
Last enriched: 08/09/2026, 05:31:21 UTC
Last updated: 08/09/2026, 05:39:51 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.