All vulnerabilities
CVE-2026-59158GHSA-fxg7-897c-57mp

nuxt-ollama: Nuxt Ollama: public runtime configuration discloses the configured cloud API key

thoda-dev nuxt-ollamanpmFrameworks
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.3.1Fixed versionOSV
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

  • 1.3.1nuxt-ollama, npmOSVnpm install nuxt-ollama@1.3.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, src/module.ts unconditionally merges all module options, including a configured cloud api_key, into runtimeConfig.public.ollama. Nuxt serializes this public configuration into the server-rendered HTML window.__NUXT__ payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. src/runtime/composables/useOllama.ts also reads the public key and sends it as an Authorization Bearer credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.

Text from CVE List

Affected versions 2

  • nuxt-ollamaaffected: < 1.3.1CVE List
  • nuxt-ollama, npmfrom 1.2.26, fixed in 1.3.1OSV

References 3