Ollama Agent mode approves Bash commands by prefix, and prompt injection can chain arbitrary commands (CVE-2026-102697)

Ollama 0.14.0 through 0.31.1 experimental Agent mode has an approval bypass vulnerability CVE-2026-102697, with a CVSS v4.0 score of 8.5, fixed in 0.31.2. The system remembers users' long-term approvals by command and path prefix, but does not fully check the actual executed content of compound commands. Attackers may therefore, through prompt injection, append unapproved operations to seemingly approved commands for execution, and the additional operations do not appear in the approval prompt. The report notes that the fixed version was released in July 2026, but the release notes at the time did not mention the security fix; as of the report, there were no reported actual exploits.