CVE-2026-59158

Name of the Vulnerable Software and Affected Versions nuxt-ollama versions prior to 1.3.1

Description A design flaw in src/module.ts causes the module to unconditionally merge all options, including the api key, into the public runtime configuration runtimeConfig.public.ollama. Because Nuxt serializes this public configuration into the server-rendered HTML window. NUXT payload, the API key is exposed in plaintext to any unauthenticated client that fetches the page. Additionally, the browser-side composable src/runtime/composables/useOllama.ts reads this public key and includes it as an Authorization Bearer credential in client-side requests. An attacker can steal this key with a single HTTP GET request, potentially leading to unauthorized cloud API usage at the operator's expense, quota exhaustion, or access to stored models and conversations.

Recommendations Update to version 1.3.1. As a temporary mitigation, avoid configuring the api key in the public module options until the update is applied.