{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6190add3-0a20-5ce9-a5cc-2334ba366591", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4", "type": "library", "name": "@nuxt/kit", "version": "3.12.3-tuxcare.4", "purl": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:364514d1-16ea-5142-bfcd-b0df9ab4339c", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6afb7ac4-706a-56db-a89d-687110dcb4a8", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:da1d80d5-e978-592b-8b00-5b2940ec3ad1", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a33b0621-93d4-53c5-a02f-e1d8ee4285ad", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:73514a35-be96-5a3c-a822-d28cc0c2487c", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:20c9d1c3-1115-59da-b7cd-210e41abbab9", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:981e4d8b-4e1f-50f3-b781-1ea28c143c71", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f7cd7019-6b73-5037-a3b9-53266e66897e", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3a1b0293-bb44-5d48-87c1-b6b9ea6aa67f", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.12.3-tuxcare.4. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:351e1252-57e6-5e6b-ab65-7837d997168b", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0d92a4ea-6fe1-59cd-a86e-89aee3418e08", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:80d6efbc-22e8-5c4f-905b-6b9765195afe", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:676c2376-6c78-5e0d-ba94-ace8e6e13dc0", "id": "CVE-2026-53721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f0d4402c-07cf-5124-b451-1d1e372b4a0d", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8f0a6b4b-f0cb-555d-a388-09e84235ee52", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:68d4012f-cb4d-57d4-80cb-09e0217d8080", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9f293361-2822-5e8f-b046-40331475ce16", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.4 of @nuxt/kit. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.4" } ] }