High, CVSS 7.8npmAmendedPublished
code-ollama: grep_search Command Injection via Unescaped $() Shell Substitution (CWE-78)
GHSA-456v-xq2p-r4cj
- Affected
- npm code-ollama <= 0.36.0
- Fixed in
- 0.36.1· Vendor fix available
- Issue
- grepsearch Command Injection via Unescaped $() Shell Substitution (CWE-78) Summary The grepsearch tool in code-ollama constructs a shell command string by interpolating attacker-controlled pattern and path arguments, then executes it via childprocess.exec(). The sanitization only escapes backslashes and double-quote characters, leaving $() command substitution and backtick expansion fully intact. A malicious or compromised Ollama server can therefore inject and execute arbitrary OS commands with the privileges of the local user running code-ollama. Because grepsearch is classified as a read-only tool, it auto-executes in Plan mode without any user approval prompt, making this a no-interaction-required exploitation path. Severity is High (CVSS 7.8). Details Vulnerable sink — src/utils/tools/filesystem/grep.ts:58-66 Only \ and " are neutralized. The shell metacharacter sequence $() (and backtick-style substitution) is passed through unmodified. The resulting string is passed to…
Recommended action: Upgrade to 0.36.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.