Ollama Agent Mode Bash Tool Command Injection

Executive Summary

Ollama versions 0.14.0 to 0.31.2 have a flaw in the agent mode Bash tool approval system. The vulnerability allows attackers who can manipulate model output via prompt injection to bypass shell command approval by appending control operators like semicolons or logical operators to approved commands. This lets them execute additional shell commands without proper session approval.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if you are running an affected version of Ollama (0.14.0 to 0.31.1). Run 'ollama version' to verify the installed version. Inspect logs for unusual command execution patterns, especially those involving shell operators like semicolons or logical operators.

Useful 0 Not Useful 0

Impact Analysis

If you use Ollama in agent mode with Bash tool approval, an attacker could trick the system into running unauthorized commands on your machine. This could lead to data theft, system compromise, or further network access depending on the commands executed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Ollama versions may face compliance violations, potential fines, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ollama to version 0.31.2 or later immediately. Disable the experimental agent mode if not required. Review and restrict user permissions to prevent unauthorized command execution. Monitor network traffic for suspicious activity.

Useful 0 Not Useful 0