{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8b5c963b-5453-59ee-ba13-05e2a95665b5", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1", "type": "library", "name": "@astrojs/rss", "version": "1.9.2-tuxcare.1", "purl": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0ddd47fa-0dfb-5b72-a728-126730417add", "id": "CVE-2013-7370", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2013-7370 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:81776cda-9070-5c54-9ba4-7676e7756998", "id": "CVE-2013-7371", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2013-7371 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b6f6327b-c596-5fb8-a031-78d1f1609e69", "id": "CVE-2018-3717", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3717 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1255fea-85c5-5fd0-bf42-070ab060c80b", "id": "CVE-2024-56140", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:526fc1f4-2dd5-5a1d-aed5-287335911576", "id": "CVE-2024-56159", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b6c8c68f-214c-5328-aea5-582b9b805906", "id": "CVE-2025-55303", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:29a23b36-a76c-570a-99d4-01bd4dc9b373", "id": "CVE-2025-61925", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ed3c64f9-9a97-5857-bddf-c91cd08ba3dc", "id": "CVE-2025-64757", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fd42880e-5ae6-5cda-bd53-4019513219a1", "id": "CVE-2025-64764", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:55c0ea58-89f6-5481-8cef-46cdf9bc2bf8", "id": "CVE-2025-64765", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b0fc20e8-f137-54d5-9dd3-3e2913e1e861", "id": "CVE-2025-65019", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9a27b9d2-5001-5480-986f-61af6e97e430", "id": "CVE-2025-66202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0fece781-a49f-593b-8164-a05d2c8e22a5", "id": "CVE-2026-41067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5ee9cb01-f70f-51fc-877f-d764ce09b12b", "id": "CVE-2026-45028", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45028 affects version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b774a285-9ea1-5983-851d-f9ae49c10dbf", "id": "CVE-2026-50146", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50146 affects version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:69fa2d1c-6a2a-5f71-9725-bec48de74ae1", "id": "CVE-2026-54298", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54298 affects version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c039f2d0-786e-5bd0-9fc3-8036c9a3c111", "id": "CVE-2026-54299", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54299 does not affect version 1.9.2-tuxcare.1 of @astrojs/rss. not_affected \u2014 Astro version 1.9.2 is not affected by CVE-2026-54299. The vulnerability requires the prerendered error page HTTP fetching feature, which was introduced in Astro 5.12.9+. Version 1.9.2 renders all error pages in-process using the component system, not via HTTP fetch, eliminating the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e01665cc-d648-5fe1-be81-9444788172d6", "id": "CVE-2026-59728", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59728 does not affect version 1.9.2-tuxcare.1 of @astrojs/rss. not_affected \u2014 Version 2.0.0 of @astrojs/rss does not support the `source` or `enclosure` fields mentioned in CVE-2026-59728. These features were added in a later version (between 2.0.0 and 4.0.19), and the vulnerability was introduced with those features. The current version cannot process RSS feed items with `source.title` or `enclosure.type` fields, making the XML injection vulnerability described in the C..." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:41c05c51-19df-57af-aae7-bcd6096f48be", "id": "CVE-2026-59729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59729 affects version 1.9.2-tuxcare.1 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:93add6c6-49a8-539a-a518-5dd7c36b4642", "id": "GHSA-4g3v-8h47-v7g6", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 does not affect version 1.9.2-tuxcare.1 of @astrojs/rss. not_affected \u2014 Astro version 1.9.2 does not contain View Transitions functionality. The vulnerable code path (packages/astro/src/runtime/server/transition.ts) does not exist because the View Transitions feature was introduced in a later version (around Astro 2.9+). The vulnerability requires View Transition animation properties to be processed and embedded in generated CSS, but this entire feature is absent f..." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40astrojs/rss@1.9.2-tuxcare.1" } ] }