The grep_search tool in code-ollama fails to properly escape shell metacharacters in user-supplied input, allowing an attacker-controlled Ollama server to inject and execute arbitrary OS commands. Because grep_search is classified as read-only, it executes without user approval.
Disclosed 28 September 2026 · Record updated 1 October 2026
Arbitrary OS command execution with privileges of the local user running code-ollama, triggered by malicious or compromised Ollama server without user interaction.
VulnerabilitiesA GitHub advisory published on 28 September 2026 says the coding agent's grep_search tool lets a malicious Ollama server run arbitrary commands without user approval.
28 Sept 2026
