DON'T WANT DRIVE-BY OLLAMA ATTACKERS SNOOPING ON YOUR LOCAL CHATS? PATCH NOW

Summary from the TLDR InfoSec newsletter

A vulnerability in Ollama Desktop v0.10.0 allowed drive-by attacks where malicious websites could bypass CORS controls to reconfigure victims' local AI settings remotely, intercept all chat messages, and even serve poisoned models. GitLab's Chris Moberly discovered the flaw by exploiting incomplete cross-origin controls—removing the Content-Type header to trick the app into treating malicious requests as "simple" and bypassing preflight checks. The vulnerability was patched within hours in v0.10.1 after Moberly disclosed it on July 31. Users are urged to update immediately as exploitation would be "trivial," according to the researcher.