{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d0da20bf-b232-51db-9f2d-87a5943610fc",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1",
      "type": "library",
      "name": "@astrojs/prism",
      "version": "4.16.19-tuxcare.1",
      "purl": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:ef293d6e-450d-5e5f-9070-2ab0930b4222",
      "id": "AIKIDO-2025-10879",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability AIKIDO-2025-10879 is fixed in version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:44b717f6-ae5e-53d8-978a-d9e03817d2b8",
      "id": "CVE-2025-55303",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-55303 affects version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:090ff367-ef9b-598e-882a-59eb98159861",
      "id": "CVE-2025-61925",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-61925 is fixed in version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c87d3f76-e01f-52f2-ba12-6f1a92004efa",
      "id": "CVE-2025-64525",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64525 is fixed in version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:52621bc0-0b26-581c-b14d-91b92ca5682d",
      "id": "CVE-2025-64757",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64757 is fixed in version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:680ac979-a7c9-5a0d-a013-a396b75f7401",
      "id": "CVE-2025-64764",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64764 is fixed in version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3aa3884f-d896-5991-95d2-9d28c75db819",
      "id": "CVE-2025-64765",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64765 is fixed in version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:09ff008d-5199-5dcd-9e09-9b3394179d00",
      "id": "CVE-2025-65019",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-65019 is fixed in version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:eca742a4-3df4-5e66-b7bc-8cec79c2a05c",
      "id": "CVE-2025-66202",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-66202 is fixed in version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:69b86bbd-7acc-5bdd-bc7f-a5c6f9b0d92d",
      "id": "CVE-2026-33490",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-33490 is a false positive for @astrojs/prism 4.16.19-tuxcare.1. false_positive \u2014 CVE-2026-33490 concerns H3 (a minimal HTTP framework), but the target repository is Astro (a website build tool). H3 is not present in this repository - no vendored code, no dependency, no imports. The only 'h3' references found are HTML heading components (<h3> tags), unrelated to the H3 framework."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9030c585-3190-5e5a-98d7-a702013684c0",
      "id": "CVE-2026-33769",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-33769 is fixed in version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a9097567-103e-57f9-95d8-9a860438606f",
      "id": "CVE-2026-41067",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41067 is fixed in version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2fc81d42-c7ea-53b2-8019-45e8c12b4074",
      "id": "CVE-2026-45028",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45028 affects version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:04f32606-3111-5d89-9475-c3eac572decd",
      "id": "CVE-2026-50146",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-50146 affects version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:14d5c58e-7f68-5275-9b12-ac6ff7d1a875",
      "id": "CVE-2026-54298",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-54298 affects version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ab08f57a-1025-56e6-9cd6-77476c107e44",
      "id": "CVE-2026-54299",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-54299 does not affect version 4.16.19-tuxcare.1 of @astrojs/prism. already_fixed \u2014 The target repository has already fixed this vulnerability via CVE-2026-25545 / AIKIDO-2025-10879 (May 7, 2026), which addresses the identical SSRF issue. The fix removes the prerendered error page fetching feature entirely, replacing it with direct SSR rendering. This is a more aggressive mitigation than the upstream's host validation approach."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:35fa75cd-5345-5d8d-a050-58bb29be4576",
      "id": "CVE-2026-59727",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59727 affects version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4fcd5f08-865e-562a-91bf-e3b8e1048e5a",
      "id": "CVE-2026-59729",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59729 affects version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7d669174-f9c9-52c2-a0a4-fb2eeec8e1a4",
      "id": "GHSA-4g3v-8h47-v7g6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 affects version 4.16.19-tuxcare.1 of @astrojs/prism."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40astrojs/prism@4.16.19-tuxcare.1"
    }
  ]
}