ZDI-CAN-27683: ZDI-26-020: (0Day) Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ollama MCP Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ollama MCP Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-15063.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-27683?
ZDI-CAN-27683 is classified as a high severity vulnerability due to its ability to allow remote code execution.
How do I fix ZDI-CAN-27683?
To mitigate ZDI-CAN-27683, update Ollama MCP Server to the latest version as mentioned in the vendor's advisory.
What systems are affected by ZDI-CAN-27683?
ZDI-CAN-27683 affects all installations of Ollama MCP Server regardless of version.
Is authentication required to exploit ZDI-CAN-27683?
No, ZDI-CAN-27683 can be exploited without authentication.
What type of vulnerability is ZDI-CAN-27683?
ZDI-CAN-27683 is a command injection vulnerability that enables remote code execution.