Ollama versions 0.14.0 through 0.31.1 contain a flaw in the experimental agent Bash tool where the approval logic incorrectly parses shell syntax. When an attacker can influence model output, for example through prompt injection, they can append control operators such as semicolons or logical operators to an approved command, causing the shell to execute unintended commands. This bypasses the intended session approval requirement and permits arbitrary command execution within the agent context, exposing the host to confidentiality, integrity, and availability risks.

Ollama’s Ollama application, specifically the experimental agent Bash component, is affected from release 0.14.0 up to and including 0.31.1. All users running those releases with experimental agent mode enabled are at risk.

The vulnerability scores a CVSS of 8.5, indicating high severity. EPSS data is not available, and it is not currently listed in CISA’s KEV catalog, but the high CVSS coupled with the ability to inject commands via prompt manipulation makes it a serious threat. The likely attack vector is remote via prompt injection when the application is exposed to untrusted input, as the attacker can influence model output to append control operators. Once the privilege bypass is achieved, the attacker can execute arbitrary shell commands, potentially compromising the host.