CVE-2026-19334

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19334", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-08T09:55:28.464Z", "datePublished": "2026-08-09T05:00:11.707Z", "dateUpdated": "2026-08-10T13:37:13.115Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-09T05:00:11.707Z"}, "title": "NightTrek Ollama-mcp index.ts command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "NightTrek", "product": "Ollama-mcp", "versions": [{"version": "80cf2e17cfc144963a475b619093a2d13c13dbc9", "status": "affected"}], "cpes": ["cpe:2.3:a:nighttrek:ollama-mcp:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-08T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-08T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-08T12:01:00.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "gongyanyu04 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/387170", "name": "VDB-387170 | NightTrek Ollama-mcp index.ts command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/387170/cti", "name": "VDB-387170 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19334", "name": "CVE-2026-19334 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/865257", "name": "Submit #865257 | NightTrek Ollama-mcp unknown Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/NightTrek/Ollama-mcp/issues/5", "tags": ["issue-tracking"]}, {"url": "https://github.com/NightTrek/Ollama-mcp/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T13:36:59.331181Z", "id": "CVE-2026-19334", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T13:37:13.115Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "NightTrek Ollama-mcp index.ts command injection", "credits": [{"lang": "en", "type": "reporter", "value": "gongyanyu04 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:nighttrek:ollama-mcp:*:*:*:*:*:*:*:*"], "vendor": "NightTrek", "product": "Ollama-mcp", "versions": [{"status": "affected", "version": "80cf2e17cfc144963a475b619093a2d13c13dbc9"}]}], "timeline": [{"lang": "en", "time": "2026-08-08T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-08T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-08T12:01:00.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/387170", "name": "VDB-387170 | NightTrek Ollama-mcp index.ts command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/387170/cti", "name": "VDB-387170 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19334", "name": "CVE-2026-19334 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/865257", "name": "Submit #865257 | NightTrek Ollama-mcp unknown Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/NightTrek/Ollama-mcp/issues/5", "tags": ["issue-tracking"]}, {"url": "https://github.com/NightTrek/Ollama-mcp/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-09T05:00:11.707Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19334", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T13:36:59.331181Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-08-10T13:37:08.307Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-19334", "state": "PUBLISHED", "dateUpdated": "2026-08-09T05:00:11.707Z", "dateReserved": "2026-08-08T09:55:28.464Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-09T05:00:11.707Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:nighttrek:ollama-mcp:*:*:*:*:*:*:*:*"], "product": "Ollama-mcp", "vendor": "NightTrek", "versions": [{"status": "affected", "version": "80cf2e17cfc144963a475b619093a2d13c13dbc9"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en NightTrek Ollama-mcp hasta 80cf2e17cfc144963a475b619093a2d13c13dbc9. Esto afecta una parte desconocida del archivo src/index.ts. Esta manipulaci\u00f3n del argumento name/modelfile/source/destination causa inyecci\u00f3n de comandos. El ataque solo puede ejecutarse localmente. Este producto est\u00e1 utilizando una versi\u00f3n continua para proporcionar entrega continua. Por lo tanto, no hay detalles de versi\u00f3n disponibles para las versiones afectadas ni actualizadas. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencia pero a\u00fan no ha respondido."}], "id": "CVE-2026-19334", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19334", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T13:36:59.331181Z", "version": "2.0.3"}}]}, "published": "2026-08-09T05:16:51.397", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/NightTrek/Ollama-mcp/"}, {"source": "cna@vuldb.com", "url": "https://github.com/NightTrek/Ollama-mcp/issues/5"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-19334"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/865257"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/387170"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/387170/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "80cf2e17cfc144963a475b619093a2d13c13dbc9"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Ollama-mcp", "source": "cna", "vendor": "NightTrek"}, "product": "ollama-mcp", "vendor": "nighttrek"}], "created": "2026-08-09T06:30:03.744502+00:00", "updated": "2026-08-11T14:27:25.847066+00:00", "vendors": ["nighttrek", "nighttrek$PRODUCT$ollama-mcp"]}