HIGH 7.5 GitHub
CVE-2026-59158
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
## Public Runtime Config Exposes Ollama API Key to Browser Clients
### Summary
`nuxt-ollama@1.2.26` unconditionally merges all module options — including `api_key` — into Nuxt's **public** runtime config (`runtimeConfig.public.ollama`). Nuxt serializes `runtimeConfig.public` into the SSR HTML response inside a `<script>` payload block (`window.__NUXT__`), making the API key visible in plaintext to any unauthenticated HTTP client that fetches the page. An attacker with no credentials can steal
Affected Products
- npm/nuxt-ollama >= 1.2.26, < 1.3.1
References
- https://github.com/advisories/GHSA-fxg7-897c-57mp
- https://github.com/thoda-dev/nuxt-ollama/security/advisories/GHSA-fxg7-897c-57mp
- https://github.com/advisories/GHSA-fxg7-897c-57mp
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-09-09 via GitHub. Affected: npm/nuxt-ollama >= 1.2.26, < 1.3.1.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.