CVE Intelligence
Analysis AI-assisted

CVE-2025-15063: Ollama MCP Server execAsync OS Command Injection Leading to Remote Code Execution

CVE-2025-15063 is a command injection flaw in the execAsync method of Ollama MCP Server, classified as CWE-78. According to the ZDI description, a user-supplied string is not validated before being used in a system call, which may allow remote code execution without authentication. The sources consulted do not show confirmed exploitation in the wild.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

ZDI advisory ZDI-26-020 describes a command injection flaw in the execAsync method of Ollama MCP Server, tracked as CVE-2025-15063 and classified as CWE-78. According to the record, the problem is the lack of validation of a user-supplied string before it is used in a system call.

Impact

  • The record describes remote code execution in the context of the service account.
  • The description states that no authentication is required.
  • The CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H corresponds to a base score of 9.8 (critical), reflecting high impact on confidentiality, integrity and availability as scored by the CNA.

Affected products and versions

  • Product: Ollama MCP Server.
  • The only identifier listed is the string 80cf2e17cfc144963a475b619093a2d13c13dbc9. It appears to be a source revision identifier rather than a released version number (inference).
  • The record does not list a range of released versions, and no fixed version is provided.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the data consulted. No confirmed exploitation in the wild appears in the sources consulted. The SSVC data in the record marks exploitation as none and automatable as yes. The EPSS probability of 0.01938 (percentile 0.79948) is a statistical estimate of exploitation likelihood, not evidence of observed attacks.

Remediation and mitigation

  • Inventory deployments that include the Ollama MCP Server component and record the exact revision in use.
  • Because the record lists no fix, check the vendor and the ZDI advisory for updates before assuming a patch exists.
  • Restrict network exposure of the service, place it behind access controls and avoid exposing it to untrusted networks.
  • Run the service under a least-privilege account to limit the effect of any code execution.

Detection guidance

  • Monitor the server process for unexpected child processes or system activity.
  • Review logs for requests to the service from unknown or unexpected sources.

Limitations of the available information

The record does not identify which inputs trigger the flaw, which released versions are affected, or whether a fix is available. The sources consulted do not include vendor confirmation. The analysis is based on the ZDI description, NVD and CVE Record pages.

Frequently asked questions

What is CVE-2025-15063?

It is a command injection vulnerability in the execAsync method of Ollama MCP Server that, according to the ZDI description, may allow remote code execution without authentication.

Is this CVE known to be actively exploited?

It is not listed in the CISA KEV catalog in the data consulted, and no confirmed exploitation in the wild appears in the sources consulted.

Is there a fixed version available?

The record does not list a fixed version. Check the vendor and the ZDI advisory for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.