CVE-2026-102697: Ollama agent mode's Bash approval can be bypassed with ; or &&
In Ollama's experimental agent mode, approving a Bash command for the session also let through anything chained onto it. A prompt injection could tack extra commands onto an approved one and run them without asking.
What it is
VulnCheck: the agent mode Bash tool approval in Ollama 0.14.0 before 0.31.2 "fails to properly parse shell syntax" and authorizes commands by prefix.
An attacker who can influence model output through prompt injection (for example, text in a web page or file the agent reads) can append control operators such as semicolons or logical operators to an approved command and run more commands, skipping the session approval step.
This only affects the experimental agent mode, not normal model serving through the Ollama API. Credited to Akıner Kısa.
How to check
- Affected: Ollama >= 0.14.0, < 0.31.2.
- You're exposed if you've used Ollama's experimental agent mode and approved Bash commands for a session.
How to fix
- Upgrade Ollama to 0.31.2 or later.
- Until then, don't use session-wide Bash approvals in agent mode, and review each command before it runs.
ollama --versionSources
- criticalCVE-2026-103663: Ollama /api/pull path traversal can lead to code execution as root
- criticalCVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operations
- highCVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader
- highCVE-2024-28224: Ollama DNS rebinding vulnerability