{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d92111e0-2c8d-53c1-8b9d-7bdf41752360",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@graphql-tools/utils",
      "purl": "pkg:npm/%40graphql-tools/utils@10.5.4",
      "type": "library",
      "bom-ref": "pkg:npm/%40graphql-tools/utils@10.5.4",
      "version": "10.5.4",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-104852",
      "affects": [
        {
          "ref": "pkg:npm/%40graphql-tools/utils@10.5.4"
        }
      ],
      "bom-ref": "urn:uuid:ee5234c5-3eb2-5e01-bd98-ffff1ac0dfa2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-104852 does not affect version 10.5.4 of @graphql-tools/utils. not_affected \u2014 The target's mergeDeep (packages/utils/src/mergeDeep.ts) has the weak pattern: it uses `key in output` and `for...in` over inherited properties, with no guard on `constructor`, `__proto__` or `prototype`. The CVE's attack chain is still broken in this version. `isObject` rejects functions, so the merge never recurses from `{}.constructor` (Object) into Function.prototype. Every write goes to a ...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2026-114604",
      "affects": [
        {
          "ref": "pkg:npm/%40graphql-tools/utils@10.5.4"
        }
      ],
      "bom-ref": "urn:uuid:fc5a4eef-155a-5528-a82b-e404226680d3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-114604 does not affect version 10.5.4 of @graphql-tools/utils. not_affected \u2014 Target @graphql-tools/utils 10.5.4 is not affected. The vulnerable hand-rolled setObjectKeyPath traversal, which was introduced by commit fbb58b51 (\"remove dset dependency\"), does not exist here. Commit fbb58b51 is not an ancestor of HEAD. mergeIncrementalResult still delegates path walking to the dset library, which the CVE reports as not exploitable (0/5 payloads). I could not re-run dset loc...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40graphql-tools/utils@10.5.4"
    }
  ]
}