nuxt-ollama: Nuxt Ollama: public runtime configuration discloses the configured cloud API key
What fixes it
- 1.3.1nuxt-ollama, npmOSV
npm install nuxt-ollama@1.3.1
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 1
1 outlet mention it. Reports are not confirmation; each links to its source.
Description
Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, src/module.ts unconditionally merges all module options, including a configured cloud api_key, into runtimeConfig.public.ollama. Nuxt serializes this public configuration into the server-rendered HTML window.__NUXT__ payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. src/runtime/composables/useOllama.ts also reads the public key and sends it as an Authorization Bearer credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.
Text from CVE List
Affected versions 2
- nuxt-ollamaaffected: < 1.3.1CVE List
- nuxt-ollama, npmfrom 1.2.26, fixed in 1.3.1OSV