{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0dbaa072-dc0c-51a0-b5c5-72f80885cc01", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4", "type": "library", "name": "@nuxt/kit", "version": "3.12.4-tuxcare.4", "purl": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a7c759e0-028b-5a29-82bb-291367a2e889", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9e340eff-7fed-50da-92ba-fc381cf47217", "id": "CVE-2025-24360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24360 is fixed in version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:80441b2b-7467-5a89-b4de-2bd204264d2b", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:54dd078d-b4f7-54d2-9dc7-5abee26b5223", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ea1b74b1-3eca-5be3-9417-bb000cd6adce", "id": "CVE-2025-58751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58751 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:eb1bf92a-3c03-5917-848d-501768490c4a", "id": "CVE-2025-59414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59414 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:26b64d8e-ccd9-5251-9406-d705902843f1", "id": "CVE-2025-62522", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-62522 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b16edb22-5bb1-5a48-8727-3a0c78f4d69f", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f3f9da07-5f0e-5a55-bcf2-1cda161e06d7", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.12.4-tuxcare.4. false_positive \u2014 CVE-2026-42338 is a false positive match for this repository. The CVE concerns the 'ip-address' npm package (specifically XSS vulnerabilities in the Address6 class), but this repository is 'nuxt' (Nuxt.js web framework version 3.12.4-tuxcare.5). Exhaustive search confirmed that the ip-address package is not present in this repository as the project itself, as a vendored/bundled copy, or as a de..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a685ff70-3f84-5259-a674-24d351afc51e", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:58c504f6-fb94-5bc2-a32b-bc0b2296f1d9", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8c94da82-fe23-5132-9217-832000fef6c8", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:efd9ada6-f0f3-582b-abdd-0fe8d2f603a6", "id": "CVE-2026-53721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2eda4fe0-9637-5927-b60a-40b01ecfbd7d", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:21ba1b3e-86de-568b-a889-6daf1a47ed6e", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:64e9be68-9059-5695-b078-8fd4d326d554", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 affects version 3.12.4-tuxcare.4 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c6d05b1f-9dae-5a73-9e2d-0fdb92e145ae", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.4-tuxcare.4 of @nuxt/kit. not_affected \u2014 Target version (nuxt@3.12.4-tuxcare.5) is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerability was introduced 1754 commits AFTER v3.12.4 when Nuxt upgraded from unhead v1 to v2 in v3.16.0. The target uses a fundamentally different, older implementation that does not contain the vulnerable innerHTML pattern." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.4" } ] }