{"data":{"id":"57e4c36a-eae5-4f40-aaba-2be26694a9ea","title":"GHSA-fxg7-897c-57mp: Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients","summary":"nuxt-ollama@1.2.26 merges all module options, including api_key, into Nuxt's public runtime config (runtimeConfig.public.ollama) in src/module.ts. Nuxt serializes that namespace into the SSR HTML window.__NUXT__ payload, so any unauthenticated HTTP client that fetches a page can read the Ollama cloud API key in plaintext and use it against the Ollama API at the operator's expense.","solution":"Recommended remediation: Move api_key to the private runtime config and remove it from the browser composable. Split _options so api_key is written to runtimeConfig.ollama, while publicOptions without api_key are merged into runtimeConfig.public.ollama. The api_key should then only be consumed in the server-side utility (src/runtime/server/utils/useOllama.ts) via useRuntimeConfig().ollama.api_key.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-fxg7-897c-57mp","publishedAt":"2026-09-09T23:47:44.000Z","cveId":"CVE-2026-59158","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":["nuxt-ollama@>= 1.2.26, < 1.3.1 (fixed: 1.3.1)"],"affectedPackageNames":["nuxt-ollama"],"affectedPackageRefs":["npm:nuxt-ollama"],"affectedVendors":[],"affectedVendorsRaw":["nuxt-ollama","Ollama"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00502,"epssCheckedAt":"2026-11-05T00:11:44.607Z","kevDateAdded":null,"advisoryAliases":["GHSA-fxg7-897c-57mp"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-09-09T23:47:44.000Z","fixReleasedAt":"2026-06-20T07:08:44.287Z","daysToFix":-81,"fixCheckedAt":"2026-10-29T21:30:52.990Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"nuxt-ollama","fixedVersion":"1.3.1","matchedVersion":"1.3.1","fixReleasedAt":"2026-06-20T07:08:44.287Z","daysToFix":-81,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:52.842Z"}]}}