{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7b0d5317-5024-5a19-8d69-0c5bb0a29ab3",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4",
      "type": "library",
      "name": "@nuxt/vite-builder",
      "version": "3.12.4-tuxcare.4",
      "purl": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:7b70f7c7-7d98-5a23-bc29-f03a1c288716",
      "id": "CVE-2022-25852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-25852 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7d2bf09b-64e9-5b38-97f8-6a3fcac21cd8",
      "id": "CVE-2025-24360",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24360 is fixed in version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8a0edb87-1a6e-5bc3-a03b-adfa161a6cb3",
      "id": "CVE-2025-24361",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4de4a3f5-84e7-57d4-913c-9eee8df0c59d",
      "id": "CVE-2025-27415",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-27415 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:aca4d346-7251-566e-aca7-30e2876e56f9",
      "id": "CVE-2025-58751",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-58751 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7e23a017-98cb-592e-80ab-e1ff97c6506d",
      "id": "CVE-2025-59414",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-59414 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:55223725-c57b-5f21-b382-b7b582e7251f",
      "id": "CVE-2025-62522",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-62522 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4f4a558b-1ffb-57dc-9e42-c153515663d1",
      "id": "CVE-2026-41305",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41305 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c7b07780-bd88-5d43-9b99-dc88d82a8d20",
      "id": "CVE-2026-42338",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/vite-builder 3.12.4-tuxcare.4. false_positive \u2014 CVE-2026-42338 is a false positive match for this repository. The CVE concerns the 'ip-address' npm package (specifically XSS vulnerabilities in the Address6 class), but this repository is 'nuxt' (Nuxt.js web framework version 3.12.4-tuxcare.5). Exhaustive search confirmed that the ip-address package is not present in this repository as the project itself, as a vendored/bundled copy, or as a de..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8a99a0ee-76ec-536e-9946-257af2be6a31",
      "id": "CVE-2026-45669",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45669 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ca080386-c933-5737-b351-10eb96036bfb",
      "id": "CVE-2026-46342",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46342 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0669deac-2eae-5db9-ac94-aee48ea1f73a",
      "id": "CVE-2026-47200",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47200 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:115f1b9a-aec0-5f96-938d-bddc5c05b55c",
      "id": "CVE-2026-53721",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53721 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7467e6d3-69f7-528c-a396-a19cc70dbbb1",
      "id": "CVE-2026-53722",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53722 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1e8de100-e6c0-5d5a-8841-21cb09a8036f",
      "id": "CVE-2026-56326",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56326 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:649e1701-0e47-50c7-ad64-2f23a53f036f",
      "id": "GHSA-c9cv-mq2m-ppp3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 affects version 3.12.4-tuxcare.4 of @nuxt/vite-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1c6bd9da-60c3-5e21-b1d1-33672df90a18",
      "id": "GHSA-m3q2-p4fw-w38m",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.4-tuxcare.4 of @nuxt/vite-builder. not_affected \u2014 Target version (nuxt@3.12.4-tuxcare.5) is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerability was introduced 1754 commits AFTER v3.12.4 when Nuxt upgraded from unhead v1 to v2 in v3.16.0. The target uses a fundamentally different, older implementation that does not contain the vulnerable innerHTML pattern."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40nuxt/vite-builder@3.12.4-tuxcare.4"
    }
  ]
}