{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:50bdf007-c214-5099-beee-01c4438775a3", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2", "type": "library", "name": "@nuxt/kit", "version": "3.12.4-tuxcare.2", "purl": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8ae75695-c0aa-587e-b428-75571a789993", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bbc14153-1713-5624-87bd-2406bfea79b7", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:08b61ed6-979b-5cd6-b82c-7b5a5ec022b2", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:45eea2a2-fd2f-572d-808c-3202c77b1302", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d6bfbe54-14ea-506d-b847-eda0af7ecc7f", "id": "CVE-2025-58751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58751 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ca34fa61-85d7-537f-ab00-8baeb7272c4c", "id": "CVE-2025-59414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59414 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:28f7d22d-bc90-50be-86ec-d666a151cf58", "id": "CVE-2025-62522", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-62522 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0779f746-3eae-5c61-9f59-c0fb84439060", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a539bb79-e332-5678-929c-1d208558e00c", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.12.4-tuxcare.2. false_positive \u2014 CVE-2026-42338 is a false positive match for this repository. The CVE concerns the 'ip-address' npm package (specifically XSS vulnerabilities in the Address6 class), but this repository is 'nuxt' (Nuxt.js web framework version 3.12.4-tuxcare.5). Exhaustive search confirmed that the ip-address package is not present in this repository as the project itself, as a vendored/bundled copy, or as a de..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5659d6e1-78cb-5088-802d-53a81b3ac804", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8a2a4240-272a-5e0c-89a0-0171693de6a6", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:007acb47-ff10-57df-b3b6-d2ad5d86b988", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b0c94f99-0598-513b-b98a-223622e7d037", "id": "CVE-2026-53721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:da21b222-1183-5556-a4ca-7206a6b0687f", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b40ddd3e-d36c-53b5-89b9-4db408113bdd", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f6ba35c9-184e-586b-aadd-ae51df6e45a9", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 affects version 3.12.4-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4cbf4dac-3c55-5d5c-aa79-21d6fa0119df", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.4-tuxcare.2 of @nuxt/kit. not_affected \u2014 Target version (nuxt@3.12.4-tuxcare.5) is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerability was introduced 1754 commits AFTER v3.12.4 when Nuxt upgraded from unhead v1 to v2 in v3.16.0. The target uses a fundamentally different, older implementation that does not contain the vulnerable innerHTML pattern." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.2" } ] }