CVE-2026-59158

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, src/module.ts unconditionally merges all module options, including a configured cloud api_key, into runtimeConfig.public.ollama. Nuxt serializes this public configuration into the server-rendered HTML window.__NUXT__ payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. src/runtime/composables/useOllama.ts also reads the public key and sends it as an Authorization Bearer credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.