{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:abab9433-a496-56a4-80fa-05735713f000",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@modelcontextprotocol/sdk",
      "purl": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2",
      "type": "library",
      "bom-ref": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2",
      "version": "1.27.1-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "@modelcontextprotocol/sdk",
            "purl": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1",
            "type": "library",
            "version": "1.27.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-66414",
      "affects": [
        {
          "ref": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f82b959c-5542-56b0-aa60-96b2eb05122e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-66414 does not affect version 1.27.1-tuxcare.2 of @modelcontextprotocol/sdk. not_affected \u2014 Target is @modelcontextprotocol/sdk 1.27.1, which is later than the 1.24.0 fix release. The upstream fix for CVE-2025-66414 (commit 09623e2a, author paulc@anthropic.com) is already in HEAD and was shipped in the upstream release. It adds the hostHeaderValidation()/localhostHostValidation() middleware and createMcpExpressApp(), which enables Host validation by default on localhost binds.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-0621",
      "affects": [
        {
          "ref": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:198a0197-f4e1-51cd-a38b-a990d6ceebf5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-0621 affects version 1.27.1-tuxcare.2 of @modelcontextprotocol/sdk."
      }
    },
    {
      "id": "CVE-2026-104850",
      "affects": [
        {
          "ref": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2294b928-4847-51e0-a805-f79b6b618b0b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-104850 is fixed in version 1.27.1-tuxcare.2 of @modelcontextprotocol/sdk."
      }
    },
    {
      "id": "CVE-2026-111767",
      "affects": [
        {
          "ref": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d94949a8-c6c7-5800-b786-58846bef190b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-111767 is fixed in version 1.27.1-tuxcare.2 of @modelcontextprotocol/sdk."
      }
    },
    {
      "id": "CVE-2026-111768",
      "affects": [
        {
          "ref": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c1f2acdb-cfc8-5d72-a62d-fe4dc82205bd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-111768 is fixed in version 1.27.1-tuxcare.2 of @modelcontextprotocol/sdk."
      }
    },
    {
      "id": "CVE-2026-111769",
      "affects": [
        {
          "ref": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:33cb98f1-b5c3-5a69-ba8a-0e8190401d73",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-111769 is fixed in version 1.27.1-tuxcare.2 of @modelcontextprotocol/sdk."
      }
    },
    {
      "id": "CVE-2026-111771",
      "affects": [
        {
          "ref": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5f4ec77f-86fa-5a9a-a252-3cf1dd061e9d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-111771 affects version 1.27.1-tuxcare.2 of @modelcontextprotocol/sdk."
      }
    },
    {
      "id": "CVE-2026-25536",
      "affects": [
        {
          "ref": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:155d4ef4-e4cd-5b9a-a6ec-d64c77153dc3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25536 affects version 1.27.1-tuxcare.2 of @modelcontextprotocol/sdk."
      }
    },
    {
      "id": "GHSA-f897-62hf-6gxq",
      "affects": [
        {
          "ref": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1c197eb1-cfa1-5a30-a97d-47ceb1a93263",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-f897-62hf-6gxq is fixed in version 1.27.1-tuxcare.2 of @modelcontextprotocol/sdk."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40modelcontextprotocol/sdk@1.27.1-tuxcare.2"
    }
  ]
}