{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d76dcd91-a1a7-5159-82bf-bc00d40c7776", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3", "type": "library", "name": "@nuxt/kit", "version": "3.12.4-tuxcare.3", "purl": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f5c40d82-f2db-5046-9660-00e64293f9f5", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:17046b64-4a09-56d7-b992-cb2ea6b5ae0a", "id": "CVE-2025-24360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24360 is fixed in version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2c3cb34c-6382-51f6-a687-1bc9a42d1fd2", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3abb2b27-fb6f-5368-af89-818d33f4e0fe", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fba4ccd7-3127-5cdc-9573-46dc4f197cf1", "id": "CVE-2025-58751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58751 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9c734ccf-0c4e-5237-9edc-668074644aa7", "id": "CVE-2025-59414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59414 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0c9a1dbe-1df8-5e48-8b9d-ccdf7da11f77", "id": "CVE-2025-62522", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-62522 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:49e0db3b-8809-5310-b872-2efce58bfed7", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8ef3cfb6-062b-5ff8-a729-51df6f9ec665", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.12.4-tuxcare.3. false_positive \u2014 CVE-2026-42338 is a false positive match for this repository. The CVE concerns the 'ip-address' npm package (specifically XSS vulnerabilities in the Address6 class), but this repository is 'nuxt' (Nuxt.js web framework version 3.12.4-tuxcare.5). Exhaustive search confirmed that the ip-address package is not present in this repository as the project itself, as a vendored/bundled copy, or as a de..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2690d657-b2c6-58c8-82f5-1b1a57b164fd", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c219a3d1-3474-5a4c-9ddd-9ca79a50250c", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c14ae7c5-e0dc-5f1d-934c-b76cc7d1456e", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c1dc9f18-f9ab-57ad-844c-add3feb21cef", "id": "CVE-2026-53721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5514452b-217e-5b47-a32e-c5802dce7f47", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:06aa899d-122e-5695-96c9-3bba34289193", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:72e0008c-3c7f-5a40-9160-2836a6ffb9d7", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 affects version 3.12.4-tuxcare.3 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bc761a29-7c9e-58f8-b7f9-f231dddc7fd7", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.4-tuxcare.3 of @nuxt/kit. not_affected \u2014 Target version (nuxt@3.12.4-tuxcare.5) is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerability was introduced 1754 commits AFTER v3.12.4 when Nuxt upgraded from unhead v1 to v2 in v3.16.0. The target uses a fundamentally different, older implementation that does not contain the vulnerable innerHTML pattern." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.3" } ] }