Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

nuxt-ollama

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

    CVE-2026-59158 · GHSA-fxg7-897c-57mp

    Affected
    • npm nuxt-ollama >= 1.2.26, < 1.3.1
    Fixed in
    1.3.1· Vendor fix available
    Issue
    Public Runtime Config Exposes Ollama API Key to Browser Clients Summary nuxt-ollama@1.2.26 unconditionally merges all module options — including apikey — into Nuxt's public runtime config (runtimeConfig.public.ollama). Nuxt serializes runtimeConfig.public into the SSR HTML response inside a <script payload block (window.NUXT), making the API key visible in plaintext to any unauthenticated HTTP client that fetches the page. An attacker with no credentials can steal the Ollama cloud API key with a single HTTP GET request, then use it to make arbitrary requests to the Ollama API at the operator's expense. Details The vulnerability is a design flaw in src/module.ts. During Nuxt module setup, the entire options object — which contains apikey when configured for cloud Ollama as documented in README.md:71-80 — is merged into the public runtime config namespace: Nuxt's SSR pipeline serializes runtimeConfig.public and embeds it in every server-rendered HTML page for client-side hydration.…

    Recommended action: Upgrade to 1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →