{"action":"Upgrade nuxt-ollama to 1.3.1 or later.","affected":[{"fixed":"1.3.1","introduced":"1.2.26"}],"component":"nuxt-ollama","cve_ids":["CVE-2026-59158"],"ecosystem":"npm","epss":0.00502,"exploited":false,"fixed_versions":["1.3.1"],"ghsa_id":"GHSA-fxg7-897c-57mp","id":"tcs_01M5KFPM7KHGVDN859J9V32H4W","modified_at":"2026-09-10T00:10:58.654611Z","published_at":"2026-09-09T23:47:44Z","references":["https://osv.dev/vulnerability/GHSA-fxg7-897c-57mp","https://github.com/thoda-dev/nuxt-ollama/security/advisories/GHSA-fxg7-897c-57mp","https://github.com/thoda-dev/nuxt-ollama"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-fxg7-897c-57mp","url":"https://osv.dev/vulnerability/GHSA-fxg7-897c-57mp"}],"summary":"Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients"}