CVE-2026-59158

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, src/module.ts unconditionally merges all module options, including a configured cloud api_key, into runtimeConfig.public.ollama. Nuxt serializes this public configuration into the server-rendered HTML window.__NUXT__ payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. src/runtime/composables/useOllama.ts also reads the public key and sends it as an Authorization Bearer credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, src/module.ts unconditionally merges all module options, including a configured cloud api_key, into runtimeConfig.public.ollama. Nuxt serializes this public configuration into the server-rendered HTML window.__NUXT__ payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. src/runtime/composables/useOllama.ts also reads the public key and sends it as an Authorization Bearer credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.

Public Runtime Config Exposes Ollama API Key to Browser Clients

Summary

nuxt-ollama@1.2.26 unconditionally merges all module options — including api_key — into Nuxt's public runtime config (runtimeConfig.public.ollama). Nuxt serializes runtimeConfig.public into the SSR HTML response inside a <script> payload block (window.__NUXT__), making the API key visible in plaintext to any unauthenticated HTTP client that fetches the page. An attacker with no credentials can steal the Ollama cloud API key with a single HTTP GET request, then use it to make arbitrary requests to the Ollama API at the operator's expense.

Details

The vulnerability is a design flaw in src/module.ts. During Nuxt module setup, the entire _options object — which contains api_key when configured for cloud Ollama as documented in README.md:71-80 — is merged into the public runtime config namespace:

// src/module.ts:35-36
const currentConfig = (runtimeConfig.public.ollama ?? {}) as OllamaOptions
runtimeConfig.public.ollama = defu(currentConfig, _options)

Nuxt's SSR pipeline serializes runtimeConfig.public and embeds it in every server-rendered HTML page for client-side hydration. This results in the api_key appearing verbatim in the window.__NUXT__ script block:

<script>
window.__NUXT__={};
window.__NUXT__.config={
  public:{
    ollama:{
      protocol:"https",
      host:"api.ollama.com",
      port:"",
      proxy:false,
      api_key:"LEAKED_TEST_KEY_123"  // ← secret exposed to browser
    }
  }
}
</script>

The browser-side composable (src/runtime/composables/useOllama.ts) then reads this value and sends it as an Authorization: Bearer header in client-side Ollama API calls:

// src/runtime/composables/useOllama.ts:6-10
const options: ModuleOptions = useRuntimeConfig().public.ollama as ModuleOptions
if (options.api_key) {
  headers.Authorization = `Bearer ${options.api_key}`
}
return new Ollama({ host, proxy: options.proxy, headers })

The complete data flow from source to sink:

1. README.md:71-80 — official documentation instructs users to set ollama.api_key for cloud Ollama models
2. src/module.ts:35-36 — source: api_key is merged into runtimeConfig.public.ollama
3. Nuxt SSR runtime — runtimeConfig.public is serialized into HTML __NUXT__ payload
4. src/runtime/composables/useOllama.ts:6 — browser composable reads useRuntimeConfig().public.ollama
5. src/runtime/composables/useOllama.ts:8-10 — sink: options.api_key becomes headers.Authorization in client-side HTTP request

The api_key value is never private (i.e., placed in runtimeConfig.ollama) and no sanitization removes it from the public namespace before serialization.

Recommended remediation: Move api_key to the private runtime config and remove it from the browser composable:

-    const currentConfig = (runtimeConfig.public.ollama ?? {}) as OllamaOptions
-    runtimeConfig.public.ollama = defu(currentConfig, _options)
+    const { api_key, ...publicOptions } = _options
+    const currentPublicConfig = (runtimeConfig.public.ollama ?? {}) as Omit<OllamaOptions, 'api_key'>
+    runtimeConfig.public.ollama = defu(currentPublicConfig, publicOptions)
+    const currentPrivateConfig = (runtimeConfig.ollama ?? {}) as Pick<ModuleOptions, 'api_key'>
+    runtimeConfig.ollama = defu(currentPrivateConfig, { api_key })

The api_key should then only be consumed in the server-side utility (src/runtime/server/utils/useOllama.ts) via useRuntimeConfig().ollama.api_key.

PoC

Prerequisites: Docker, Python 3

Step 1 — Build the vulnerable Nuxt app container

docker build \
  -f /path/to/vuln-001/Dockerfile \
  -t nuxt-ollama-vuln-001 \
  /path/to/npmAI_735_thoda-dev__nuxt-ollama

The Dockerfile uses the nuxt-ollama source at commit 6989ea8 and injects the following playground/nuxt.config.ts — the exact cloud configuration…

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, src/module.ts unconditionally merges all module options, including a configured cloud api_key, into runtimeConfig.public.ollama. Nuxt serializes this public configuration into the server-rendered HTML window.__NUXT__ payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. src/runtime/composables/useOllama.ts also reads the public key and sends it as an Authorization Bearer credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, src/module.ts unconditionally merges all module options, including a configured cloud api_key, into runtimeConfig.public.ollama. Nuxt serializes this public configuration into the server-rendered HTML window.__NUXT__ payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. src/runtime/composables/useOllama.ts also reads the public key and sends it as an Authorization Bearer credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.

Public Runtime Config Exposes Ollama API Key to Browser Clients

Summary

nuxt-ollama@1.2.26 unconditionally merges all module options — including api_key — into Nuxt's public runtime config (runtimeConfig.public.ollama). Nuxt serializes runtimeConfig.public into the SSR HTML response inside a <script> payload block (window.__NUXT__), making the API key visible in plaintext to any unauthenticated HTTP client that fetches the page. An attacker with no credentials can steal the Ollama cloud API key with a single HTTP GET request, then use it to make arbitrary requests to the Ollama API at the operator's expense.

Details

The vulnerability is a design flaw in src/module.ts. During Nuxt module setup, the entire _options object — which contains api_key when configured for cloud Ollama as documented in README.md:71-80 — is merged into the public runtime config namespace:

// src/module.ts:35-36
const currentConfig = (runtimeConfig.public.ollama ?? {}) as OllamaOptions
runtimeConfig.public.ollama = defu(currentConfig, _options)

Nuxt's SSR pipeline serializes runtimeConfig.public and embeds it in every server-rendered HTML page for client-side hydration. This results in the api_key appearing verbatim in the window.__NUXT__ script block:

<script>
window.__NUXT__={};
window.__NUXT__.config={
  public:{
    ollama:{
      protocol:"https",
      host:"api.ollama.com",
      port:"",
      proxy:false,
      api_key:"LEAKED_TEST_KEY_123"  // ← secret exposed to browser
    }
  }
}
</script>

The browser-side composable (src/runtime/composables/useOllama.ts) then reads this value and sends it as an Authorization: Bearer header in client-side Ollama API calls:

// src/runtime/composables/useOllama.ts:6-10
const options: ModuleOptions = useRuntimeConfig().public.ollama as ModuleOptions
if (options.api_key) {
  headers.Authorization = `Bearer ${options.api_key}`
}
return new Ollama({ host, proxy: options.proxy, headers })

The complete data flow from source to sink:

1. README.md:71-80 — official documentation instructs users to set ollama.api_key for cloud Ollama models
2. src/module.ts:35-36 — source: api_key is merged into runtimeConfig.public.ollama
3. Nuxt SSR runtime — runtimeConfig.public is serialized into HTML __NUXT__ payload
4. src/runtime/composables/useOllama.ts:6 — browser composable reads useRuntimeConfig().public.ollama
5. src/runtime/composables/useOllama.ts:8-10 — sink: options.api_key becomes headers.Authorization in client-side HTTP request

The api_key value is never private (i.e., placed in runtimeConfig.ollama) and no sanitization removes it from the public namespace before serialization.

Recommended remediation: Move api_key to the private runtime config and remove it from the browser composable:

-    const currentConfig = (runtimeConfig.public.ollama ?? {}) as OllamaOptions
-    runtimeConfig.public.ollama = defu(currentConfig, _options)
+    const { api_key, ...publicOptions } = _options
+    const currentPublicConfig = (runtimeConfig.public.ollama ?? {}) as Omit<OllamaOptions, 'api_key'>
+    runtimeConfig.public.ollama = defu(currentPublicConfig, publicOptions)
+    const currentPrivateConfig = (runtimeConfig.ollama ?? {}) as Pick<ModuleOptions, 'api_key'>
+    runtimeConfig.ollama = defu(currentPrivateConfig, { api_key })

The api_key should then only be consumed in the server-side utility (src/runtime/server/utils/useOllama.ts) via useRuntimeConfig().ollama.api_key.

PoC

Prerequisites: Docker, Python 3

Step 1 — Build the vulnerable Nuxt app container

docker build \
  -f /path/to/vuln-001/Dockerfile \
  -t nuxt-ollama-vuln-001 \
  /path/to/npmAI_735_thoda-dev__nuxt-ollama

The Dockerfile uses the nuxt-ollama source at commit 6989ea8 and injects the following playground/nuxt.config.ts — the exact cloud configuration…