Shell injection flaw in code-ollama runs commands with no prompt

A GitHub security advisory published on 28 September 2026 describes a command injection flaw in code-ollama, a command-line coding agent distributed on npm. According to the advisory, GHSA-456v-xq2p-r4cj, a malicious or compromised Ollama server can make the agent run arbitrary operating system commands with the privileges of the local user, and it can do so without any approval prompt. The advisory rates the issue High, with a CVSS score of 7.8, and classifies it as CWE-78, the category for OS command injection.

The problem sits in the agent's grep_search tool, which searches files using ripgrep. The advisory says the tool builds a shell command as a text string, inserting the pattern and path values supplied by the model, then passes the whole string to child_process.exec() in Node.js. That function hands the string to /bin/sh, which interprets shell syntax before ripgrep ever starts.

The sanitisation applied to those values only escapes backslashes and double-quote characters, according to the advisory. Command substitution using $() and backticks — shell syntax that runs an embedded command and replaces it with the output — is left untouched. So a pattern such as $(id>/tmp/poc-evidence) is executed by the shell as a command in its own right.

The advisory traces the full path from the external model to the vulnerable code. Tool calls arrive in the chat stream from the Ollama server, are forwarded by the CLI to the tool dispatcher, and the pattern and path arguments are passed verbatim into the grep function, where the incomplete escaping happens and the command string is assembled.

What makes this worse, the advisory says, is how the agent classifies the tool. grep_search is listed among the read-only tool names and is exposed in Plan mode. Read-only tools execute automatically, without showing the user an approval prompt. The advisory describes exploitation as requiring "zero user interaction beyond the initial code-ollama run invocation".

The report includes a working proof of concept against version 0.36.0. It uses a short Python script that impersonates an Ollama server on the default port, answers the first chat request with a grep_search tool call carrying the injected pattern, and then replies normally. A Dockerfile is provided to reproduce the whole thing in a container; the advisory shows the marker file containing uid=0(root), indicating the injected command ran as root inside that container. Running the agent manually against the fake server produces the same marker file on disk.

The advisory's recommended fix is to stop building a shell string at all. It proposes replacing the execShell call with an argument-vector call using execFile, which passes arguments directly to the ripgrep binary rather than through a shell, along with a 30-second timeout and a one-megabyte output buffer.

The incident record for this issue lists the status as reported. The advisory does not name a patched version. Users of code-ollama who point the tool at an Ollama endpoint they do not control should treat that endpoint as capable of running commands on their machine.