Nuxt Ollama module exposes configured cloud API key in the client-side window.__NUXT__ payload

src/module.ts merges the configured cloud api_key into runtimeConfig.public.ollama and useOllama.ts reads that public key, exposing the credential in plaintext to any client that fetches a page without requiring an Ollama request to be made. A stolen key permits unauthorized cloud API calls, quota/rate-limit abuse, and access to stored models or conversations.

This leaks the LLM-provider credential for an AI application to anyone who can load a page, enabling LLMjacking-style abuse of the operator's model API account and billing.

The module unconditionally merges all module options, including the cloud api_key, into runtimeConfig.public.ollama, which Nuxt serializes into the server-rendered HTML window.__NUXT__ payload; the key is also sent as an Authorization Bearer from browser-side Ollama requests.

nuxt-ollama < 1.3.1

Upgrade to nuxt-ollama 1.3.1 (GHSA-fxg7-897c-57mp); move the API key out of runtimeConfig.public so it is not serialized client-side.