Skip to content
Heist/ feed
Back to feed
High

Remote Code Execution in Ollama via Update Mechanism

Type: advisorySources: OSV

Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading updates, the application constructs local file paths using values derived from HTTP headers without validation. These values are passed directly to filepath.Join, allowing path traversal sequences (../) to be resolved and enabling files to be written outside the intended update staging directory. An attacker who can influence update responses can exploit this flaw to write arbitrary executables to attacker‑chosen locations accessible to the current user, including the Windows Startup directory. This allows execution of arbitrary executables. Critically, when chained with CVE‑2026‑42248 (Missing Signature Verification for Updates), an attacker can deliver malicious payloads that are written to sensitive locations and executed automatically. Because Ollama for Windows performs silent automatic updates and executes staged binaries without user interaction, this results in automatic and persistent code execution without user awareness. Maintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-42249
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 03:45 UTC · Revision 1

Source evidence

Remote Code Execution in Ollama via Update Mechanism

core-osv · Original source

Published 29 Apr 2026, 11:44 UTC

Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading updates, the application constructs local file paths using values derived from HTTP headers without validation. These values are passed directly to filepath.Join, allowing path traversal sequences (../) to be resolved and enabling files to be written outside the intended update staging directory. An attacker who can influence update responses can exploit this flaw to write arbitrary executables to attacker‑chosen locations accessible to the current user, including the Windows Startup directory. This allows execution of arbitrary executables. Critically, when chained with CVE‑2026‑42248 (Missing Signature Verification for Updates), an attacker can deliver malicious payloads that are written to sensitive locations and executed automatically. Because Ollama for Windows performs silent automatic updates and executes staged binaries without user interaction, this results in automatic and persistent code execution without user awareness. Maintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

osv:CVE-2026-42249
Complete source record
{
  "id": "2408dd5b5c6abd70629c5ce425c3d3f7c8d124b74a41511babe2e1809ebca1a7",
  "url": "https://osv.dev/vulnerability/CVE-2026-42249",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Remote Code Execution in Ollama via Update Mechanism",
    "summary": "Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading updates, the application constructs local file paths using values derived from HTTP headers without validation. These values are passed directly to filepath.Join, allowing path traversal sequences (../) to be resolved and enabling files to be written outside the intended update staging directory. An attacker who can influence update responses can exploit this flaw to write arbitrary executables to attacker‑chosen locations accessible to the current user, including the Windows Startup directory. This allows execution of arbitrary executables. Critically, when chained with CVE‑2026‑42248 (Missing Signature Verification for Updates), an attacker can deliver malicious payloads that are written to sensitive locations and executed automatically. Because Ollama for Windows performs silent automatic updates and executes staged binaries without user interaction, this results in automatic and persistent code execution without user awareness. Maintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.",
    "evidence": "osv:CVE-2026-42249",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-42249",
      "aliases": [
        "CVE-2026-42249"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/ollama/ollama",
              "type": "GIT",
              "events": [
                {
                  "introduced": "80d34260ea16e76c9ef0d014a86cc130421855f1"
                },
                {
                  "last_affected": "86513cb697c9842265863b03ba1e916b959a63c0"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0.12.10"
                      },
                      {
                        "last_affected": "0.17.5"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "cpe": "cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0.12.10"
                      },
                      {
                        "last_affected": "0.17.5"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.17.5",
            "v0.17.4",
            "v0.17.3",
            "v0.17.2",
            "v0.17.1",
            "v0.17.1-rc2",
            "v0.17.1-rc1",
            "v0.17.1-rc0",
            "v0.17.0-rc2",
            "v0.17.0",
            "v0.17.0-rc1",
            "v0.17.0-rc0",
            "v0.16.3-rc2",
            "v0.16.3",
            "v0.16.3-rc1",
            "v0.16.3-rc0",
            "v0.16.2-rc0",
            "v0.16.2",
            "v0.16.1",
            "v0.16.0-rc2",
            "v0.16.0",
            "v0.16.0-rc1",
            "v0.16.0-rc0",
            "v0.15.6",
            "v0.15.5",
            "v0.15.5-rc5",
            "v0.15.5-rc4",
            "v0.15.5-rc3",
            "v0.15.5-rc1",
            "v0.15.5-rc2",
            "v0.15.5-rc0",
            "v0.15.4",
            "v0.15.3",
            "v0.15.1",
            "v0.15.2",
            "v0.15.1-rc1",
            "v0.15.1-rc0",
            "v0.15.0-rc6",
            "v0.15.0",
            "v0.15.0-rc5",
            "v0.15.0-rc4",
            "v0.15.0-rc3",
            "v0.15.0-rc2",
            "v0.15.0-rc1",
            "v0.15.0-rc0",
            "v0.14.3",
            "v0.14.3-rc3",
            "v0.14.3-rc2",
            "v0.14.0-rc10",
            "v0.14.3-rc1",
            "v0.14.3-rc0",
            "v0.14.2",
            "v0.14.2-rc1",
            "v0.14.2-rc0",
            "v0.14.1",
            "v0.14.0-rc11",
            "v0.14.0",
            "v0.14.0-rc9",
            "v0.14.0-rc8",
            "v0.14.0-rc7",
            "v0.14.0-rc6",
            "v0.14.0-rc5",
            "v0.14.0-rc4",
            "v0.14.0-rc3",
            "v0.14.0-rc2",
            "v0.14.0-rc1",
            "v0.14.0-rc0",
            "v0.13.5-rc1",
            "v0.13.5",
            "v0.13.5-rc0",
            "v0.13.4-rc2",
            "v0.13.4",
            "v0.13.4-rc1",
            "v0.13.4-rc0",
            "v0.13.3",
            "v0.13.3-rc1",
            "v0.13.3-rc0",
            "v0.13.2",
            "v0.13.2-rc2",
            "v0.13.2-rc1",
            "v0.13.2-rc0",
            "v0.13.1",
            "v0.13.1-rc2",
            "v0.13.1-rc1",
            "v0.13.1-rc0",
            "v0.13.0-rc0",
            "v0.13.0",
            "v0.12.11",
            "v0.12.11-rc1",
            "v0.12.11-rc0",
            "v0.12.10-rc1",
            "v0.12.10"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42249.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.310873247Z",
      "provider": "osv",
      "references": [
        "https://ollama.com/",
        "https://cert.pl/en/posts/2026/04/CVE-2026-42248/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42249.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-42249",
        "https://github.com/ollama/ollama"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22",
          "CWE-494"
        ],
        "cna_assigner": "CERT-PL",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42249.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-42249",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 522321,
  "published_at": "2026-04-29T11:44:39.807+00:00"
}