CVE-2026-59158: Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

nuxt-ollama@1.2.26 unconditionally merges all module options — including api_key — into Nuxt’s public runtime config (runtimeConfig.public.ollama). Nuxt serializes runtimeConfig.public into the SSR HTML response inside a <script> payload block (window.__NUXT__), making the API key visible in plaintext to any unauthenticated HTTP client that fetches the page. An attacker with no credentials can steal the Ollama cloud API key with a single HTTP GET request, then use it to make arbitrary requests to the Ollama API at the operator’s expense.