{"data":{"id":"57e4c36a-eae5-4f40-aaba-2be26694a9ea","title":"GHSA-fxg7-897c-57mp: Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients","summary":"Nuxt Ollama version 1.2.26 has a vulnerability where API keys for the Ollama service are accidentally placed in public runtime configuration (data that gets sent to web browsers). This means anyone can visit the website, look at the page source code, and steal the API key in plain text, then use it to make expensive API calls at the website owner's expense.","solution":"Move the `api_key` from public runtime config to private runtime config by separating it from other options during module setup. The `api_key` should only be used on the server side through `useRuntimeConfig().ollama.api_key` in server utilities, not sent to the browser. The source text provides a code diff showing how to split `api_key` from `publicOptions` and place it in `runtimeConfig.ollama` instead of `runtimeConfig.public.ollama`.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-fxg7-897c-57mp","publishedAt":"2026-09-09T23:47:44.000Z","cveId":"CVE-2026-59158","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["pii_leakage"],"issueType":"vulnerability","affectedPackages":["nuxt-ollama@>= 1.2.26, < 1.3.1 (fixed: 1.3.1)"],"affectedVendors":[],"affectedVendorsRaw":["Ollama","Nuxt"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-09-09T23:47:44.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}