CVE-2026-59158
CVE-2026-59158 · Nuxt Ollama: public runtime configuration discloses the configured cloud API key
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.
CVSS 7.5 · Alta · EPSS 0,5% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
nuxt-ollama
- Versiones
- < 1.3.1: Afectada
Sin corrección publicada
nuxt-ollama npm
- Intervalos de versiones afectados
- SEMVER: ≥ 1.2.26, < 1.3.1
Actualiza a 1.3.1