GHSA-456V-XQ2P-R4CJ: OS Command Injection in code-ollama grep_search Tool

The code-ollama library is a command-line utility designed to integrate local large language models (LLMs) with software development workflows. This tool allows models to interact with the local filesystem through a suite of registered operations. These operations facilitate actions such as reading files, writing files, and searching directory structures.\n\nTo optimize directory search capabilities, the utility includes a grep_search tool. This component utilizes the system's ripgrep (rg) binary to perform fast, indexed searches of user-specified patterns within a target directory path.\n\nBecause grep_search is designated as a read-only tool within the code-ollama constants registry, the application does not prompt the user for execution approval. During plan execution, the CLI automatically runs this command upon receiving a tool call request from the model. This behavior enables a direct command execution pipeline requiring zero manual validation.

The core vulnerability is located in the grep_search implementation within the file src/utils/tools/filesystem/grep.ts. The application attempts to sanitize user-supplied input parameters using simple regular expression replacements. Specifically, the sanitization replaces all instances of backslashes and double-quotes with escaped counterparts.\n\nWhile this replacement prevents parameter containment breakout in standard string contexts, it fails to account for POSIX shell parsing dynamics within double-quoted arguments. In shell interpreters like bash or sh, command substitution structures such as $() and backticks remain active inside double-quotes. The sanitization logic does not neutralize or escape these characters.\n\nWhen the sanitized pattern is concatenated into a final command string, it is forwarded to Node.js's child_process.exec() API. Because child_process.exec() spawns an intermediate system shell (/bin/sh) to execute the command, the shell evaluates the nested command substitutions prior to executing the primary ripgrep binary, triggering the injection.

An inspection of the vulnerable implementation in v0.36.0 shows that the shell execution string is dynamically constructed via template literals:\n\ntypescript\n// Vulnerable Code Path (v0.36.0)\nconst escapedPattern = searchPattern\n .replace(/\\\\/g, '\\\\\\\\')\n .replace(/\"/g, '\\\\\"');\nconst escapedDirPath = dirPath.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"');\n\nconst { stdout } = await execShell(\n `rg --line-number --no-heading --smart-case \"${escapedPattern}\" \"${escapedDirPath}\"`,\n);\n\n\nThe patch resolves this vulnerability by migrating from shell execution to binary execution. The child_process.execFile() function is used to invoke the binary directly without spawning an intermediary shell interpreter. This eliminates shell syntax parsing entirely.\n\ntypescript\n// Patched Code Path (v0.36.1)\nimport { execFile } from '../../node';\n\nconst RG_EXEC_OPTIONS = { timeout: 30_000, maxBuffer: 1024 * 1024 };\n\nconst { stdout } = await execFile(\n 'rg',\n ['--line-number', '--no-heading', '--smart-case', '--', searchPattern, dirPath],\n RG_EXEC_OPTIONS,\n);\n

An attacker must compromise or control the Ollama server endpoint queried by the victim's code-ollama client. Alternatively, an attacker could trigger a prompt-injection state where a local or remote model is forced to call the grep_search tool with a malicious pattern.\n\nWhen the target connects to the rogue Ollama instance, the server returns a crafted JSON payload containing tool call instructions. The payload specifies the grep_search function and supplies the command injection string inside the pattern field.\n\nmermaid\ngraph LR\n Server["Rogue Ollama Server"] -->|\"Returns Tool Call: grep_search\"| Client["code-ollama Client"]\n Client -->|\"Checks Read-Only Tool List\"| AutoExecute["Auto-Execution Route (No Prompt)"]\n AutoExecute -->|\"Regex Replacement Fail\"| Escape["Incomplete Sanitization"]\n Escape -->|\"Executes String via Shell\"| System["Target OS Shell Command Executed"]\n\n\nBecause the pattern field contains active command substitution characters, the system shell evaluates the nested command. The command executes with the privileges of the system user running the CLI tool.

The successful exploitation of this vulnerability results in full local operating system access within the context of the running developer. Because software development environments typically possess direct read and write permissions to confidential source code, access credentials, and SSH keys, the potential impact is severe.\n\nAn attacker can exfiltrate sensitive environment variables, manipulate source code during development, and modify system configuration files. Additionally, the execution takes place silently in the background because the tool runs automatically during Plan Mode operations.\n\nThe CVSS v3.1 score is calculated at 7.8 (High), with a vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This reflects that while local access is required for execution, no special privileges are needed, and the integrity, confidentiality, and availability impacts are elevated.

The primary remediation action is upgrading the code-ollama npm package to version 0.36.1 or later. This version replaces the insecure string-based child_process.exec() call with child_process.execFile(), preventing the host shell from evaluating parameter arguments.\n\nWhen direct updates are not immediately feasible, operators should configure their network firewalls to restrict local CLI tools to trusted Ollama endpoints. Organizations should block outgoing connections to external, arbitrary LLM server providers.\n\nDevelopers should audit any local AI tools to confirm that shell wrapper functions are not utilized for filesystem queries. Ensure that security policies mandate user validation and approval for all external tool executions, regardless of their read-only designation.