Ollama's agent mode ran extra shell commands after one approval

What happened

Ollama's experimental agent mode approved Bash commands by their prefix, so an attacker who could steer the model through prompt injection could append a semicolon or a logical operator to an approved command and run more commands with no new approval. CVE-2026-102697, published on 29 September 2026, scores it CVSS 3.1 7.8 and covers versions from 0.14.0 up to 0.31.2.

Ollama 0.31.2 fixes it. The CVSS vector rates it a local attack that needs user interaction: someone running agent mode on content an attacker can influence.