{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:84c0c585-a8cc-5564-83e2-a0a4f230e746", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8", "type": "library", "name": "@nuxt/kit", "version": "3.12.4-tuxcare.8", "purl": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f6acafed-e8a9-5937-a15f-e7166932b41b", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fa95551b-c20f-5be4-be6b-395a958e0036", "id": "CVE-2025-24360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24360 is fixed in version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0f7e9f16-6e49-5f65-ac34-5077459c81cf", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b2fcc0fb-89af-5af7-8910-1c601aa3bfae", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:71edb791-655a-5271-8d3e-589e853bae6a", "id": "CVE-2025-58751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58751 affects version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1b22140e-2263-5411-b7d0-63f91750308d", "id": "CVE-2025-59414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59414 affects version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:da88a96e-cca9-5c0b-af13-478a8833a57d", "id": "CVE-2025-62522", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62522 is fixed in version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:71a3a04f-7a20-5a55-95e0-b6bfb54eafd2", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6ddcc674-863a-5ff7-9c04-b63172e345bd", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.12.4-tuxcare.8. false_positive \u2014 CVE-2026-42338 is a false positive match for this repository. The CVE concerns the 'ip-address' npm package (specifically XSS vulnerabilities in the Address6 class), but this repository is 'nuxt' (Nuxt.js web framework version 3.12.4-tuxcare.5). Exhaustive search confirmed that the ip-address package is not present in this repository as the project itself, as a vendored/bundled copy, or as a de..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9927acd6-21f2-5cd6-b087-6bec67665ee9", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:33261a91-d707-55c8-9bfb-755f0dae27c3", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fc854b10-8339-5df5-8df6-78c5a29a9fe2", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:748097ff-f0ac-51a4-903c-4bfc052b6ec3", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1c4f807b-4f8a-5727-813c-a2524a0becac", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:03534374-8468-5d74-9028-c58e8d70495e", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3d2d53c6-227e-53b2-8463-7c69d82e0a02", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.4-tuxcare.8 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b682556b-ff0f-5b06-8278-d5273747921d", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.4-tuxcare.8 of @nuxt/kit. not_affected \u2014 Target version (nuxt@3.12.4-tuxcare.5) is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerability was introduced 1754 commits AFTER v3.12.4 when Nuxt upgraded from unhead v1 to v2 in v3.16.0. The target uses a fundamentally different, older implementation that does not contain the vulnerable innerHTML pattern." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.8" } ] }