{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8c2dc597-66f5-5a43-b6a8-345fa9060ea2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@astrojs/prism", "purl": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8", "version": "3.6.5-tuxcare.8", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-47885", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:775fe8f5-edce-54ff-81ec-bf4c50f3c270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47885 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2024-56140", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:6b0b1d12-8c2a-5f99-853a-6bb11778c17c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2024-56159", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:38014bf5-9b97-5d5f-ae9d-a94f195d8d1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2025-55303", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:fa16382d-111d-5451-a232-e8637ceab31f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2025-61925", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:de3091a2-4ca6-560d-8543-8ac8aba03684", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2025-64525", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:8aff3239-addd-5ac0-8522-7e577cf93738", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64525 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2025-64757", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:10a3a67b-756f-58ea-9a8a-59c556416ea2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2025-64764", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:c0cb46d2-55a2-5185-b604-d7086ce26061", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2025-64765", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:6e8233a5-a500-5dca-9e0d-26abaf9eaa36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2025-65019", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:446016fb-499e-53ee-afe2-c1919628c25c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2025-66202", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:dbb4c101-4e97-51b3-be64-14554174ed33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2026-33769", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:49903936-5ae0-549b-8ad6-b2f37982da09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2026-41067", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:6be01082-d86b-5e7e-9a1b-dacacdbfecfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2026-45028", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:ab3be229-861f-5835-9f9a-3c69333f2bbc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-45028 does not affect version 3.6.5-tuxcare.8 of @astrojs/prism. not_affected \u2014 Astro version 3.6.5 is NOT AFFECTED by CVE-2026-45028. The vulnerability concerns server islands encryption (AES-GCM ciphertext replay between props and slots), but server islands functionality does not exist in version 3.6.5. The feature was introduced in later versions (~May 2025, v5.x/6.x), and the vulnerability was fixed in v6.1.10 (April 2026). Exhaustive search across 327 source files con...", "justification": "code_not_present" } }, { "id": "CVE-2026-50146", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:b944e425-fb9d-50df-9a0f-c45d4aac62cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2026-54298", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:4aff0401-3f0b-590f-8543-bcbe5ebec4ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2026-54299", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:549468d6-9e68-582a-aea5-776073367ef5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54299 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2026-59728", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:20694ea9-b682-5cff-8b50-86cfbb954b81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59728 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2026-59729", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:30e6955e-ba85-526b-bc9c-8b41b40c84f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59729 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2026-73422", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:91eba924-69ae-549b-a6d9-c9f3194561ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-73422 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "CVE-2026-84376", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:5ee75bb0-499a-5a75-ad23-81029b3fb14d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84376 affects version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "GHSA-26w7-cxv4-gfx2", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:c15cfccb-7b58-52e7-8830-dc9d169a929f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-26w7-cxv4-gfx2 affects version 3.6.5-tuxcare.8 of @astrojs/prism." } }, { "id": "GHSA-4g3v-8h47-v7g6", "affects": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ], "bom-ref": "urn:uuid:685ad1de-d045-5efc-bfea-5977ae3dc778", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 is fixed in version 3.6.5-tuxcare.8 of @astrojs/prism." } } ], "dependencies": [ { "ref": "pkg:npm/%40astrojs/prism@3.6.5-tuxcare.8" } ] }