{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9690eb69-aadf-5498-8ba5-9ec8b19fd001", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6", "type": "library", "name": "@nuxt/kit", "version": "3.12.3-tuxcare.6", "purl": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9fb2a3aa-3dea-535e-9855-1bdd8b393986", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b0c113a2-f284-57bf-bacf-c63dbc417248", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:03962a90-e953-5e3d-b4b8-a1c7b5340f5f", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3f6b205f-fdea-5a15-9f48-69866bd0eaa6", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d51c4e65-38d0-50f9-b4c9-4d0907ca602e", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b90c7648-ed1d-5e33-9672-75d981494773", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7911000f-1e51-5cf4-9d1f-158f8e995a83", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5c77ee5a-0354-53c5-9b53-cf151bf5a036", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:27fb9139-1688-53c4-9f98-e7918e1237ed", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.12.3-tuxcare.6. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1fb64648-af38-5bc6-b3ae-b818c3446cde", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:68586548-162a-5157-a905-db7eedf05247", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:88951cf3-e4e0-53a4-b7c3-0d189a11576b", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c2ab5a8f-1406-5be6-a47a-31364c89fd4f", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:414844e4-85a0-54cf-ae41-67ddd94d3094", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c8d67b50-3a8f-5d7f-a3fb-07c216bb6520", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6f615cb8-2956-5135-870c-a70a280ddaa8", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.6 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4f5e24cd-4866-54c0-8adc-6206dd9236d1", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.6 of @nuxt/kit. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.6" } ] }