Summary
A high-severity authorization flaw in Ollama's experimental agent-mode Bash tool can allow shell commands to run without the required session approval. The issue becomes risky when an attacker can influence model output through prompt injection and cause the tool to misinterpret an approved command's shell syntax.
Affected context
The vulnerability occurs in Ollama versions 0.14.0 before 0.31.2 when experimental agent mode uses the Bash tool approval mechanism. It requires a deployment in which model output can influence tool invocation and the approval logic does not correctly account for shell control syntax appended to an otherwise approved command.
Exploit preconditions
- Attack surface: Experimental agent-mode Bash tool
- Required access: Ability to influence model behavior or output, typically through prompt injection or untrusted agent context
- Trigger point: Authorization and approval processing for a proposed shell command
- Why exploitation is possible: The approval mechanism may validate only part of the command and fail to enforce authorization for additional shell operations represented in the same input
Why this happens
The underlying bug is an authorization decision that does not faithfully represent the complete operation eventually interpreted by the shell. Because shell syntax is parsed incompletely, an input that appears to match an approved command may include additional operations that fall outside the approved scope. This maps to CWE-863: Incorrect Authorization, where access-control checks fail to enforce the intended permissions for the requested action.
Potential impact
- An attacker may execute unauthorized shell commands in the Ollama runtime
- Sensitive files, environment variables, or credentials could be exposed
- The host or container could be modified or disrupted
- Compromised runtime access could enable further lateral movement, depending on privileges
General mitigation guidance
Mitigation generally focuses on making authorization decisions over a structured, fully parsed representation of the requested action rather than over ambiguous command text.
Common defensive patterns include:
- Separating command approval from shell interpretation and avoiding implicit shell evaluation
- Allowing only narrowly defined commands and arguments through a secure-by-default policy
- Treating model-generated tool requests and all surrounding context as untrusted
- Requiring explicit approval for each distinct operation rather than approving a command prefix
- Running agent processes with least privilege, restricted filesystem access, and limited network permissions
- Applying containment controls so a compromised tool process cannot access unnecessary host resources
How teams detect issues like this
Organizations can look for:
- Static analysis findings involving partial command matching, shell invocation, or authorization checks performed before complete parsing
- Code-review signals such as prefix-based allowlists, string comparisons for shell commands, and approval logic that differs from execution logic
- Policy enforcement that blocks unrestricted shell interpreters in agent tools or requires structured command schemas
- Runtime monitoring for agent-issued commands that differ from approved command records or contain unexpected control syntax
- Automated security review tools configured to identify command injection and authorization-boundary weaknesses
