GHSA-fxg7-897c-57mp: Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients
HIGHHigh-risk vulnerability — CVSS 7.5
## Public Runtime Config Exposes Ollama API Key to Browser Clients ### Summary `nuxt-ollama@1.2.26` unconditionally merges all module options — including `api_key` — into Nuxt's **public** runtime config (`runtimeConfig.public.ollama`). Nuxt serializes `runtimeConfig.public` into the SSR HTML response inside a ` ` payload block (`window.__NUXT__`), making the API key visible in plaintext to any unauthenticated HTTP client that fetches the page. …
CVE · detail
Early access
Get the next one first.
Early access opens the actor API and MCP server first, plus alerts when an adversary you follow lands on the wire. One email when it's ready. Nothing else, ever.
bot-protected