{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:748ba5db-2394-5373-b640-a379499b21c8",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6",
      "type": "library",
      "name": "@nuxt/webpack-builder",
      "version": "3.12.3-tuxcare.6",
      "purl": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:e7916a16-7de3-559f-a890-1f1e37ef1777",
      "id": "CVE-2022-25852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-25852 affects version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:76c7a1b4-07fe-5572-bb9a-2c424d17a009",
      "id": "CVE-2024-34343",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:40c53537-9a7f-5b84-beb5-6fa6d700a473",
      "id": "CVE-2024-34344",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2cbcb318-e1fe-51b0-8d18-8b150abad8dc",
      "id": "CVE-2025-24360",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b5baafc2-c058-557b-bf0b-525904af820f",
      "id": "CVE-2025-24361",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bf0389c8-739c-5ec8-9bfd-eed33799e8d5",
      "id": "CVE-2025-27415",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:be174337-5317-5eb6-85bc-cb0f5a1e76fd",
      "id": "CVE-2025-59414",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:caa5bd49-879e-5fcb-bc87-e0055a3e9820",
      "id": "CVE-2026-41305",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:af6feccd-7461-5255-8a6e-c534edf81483",
      "id": "CVE-2026-42338",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/webpack-builder 3.12.3-tuxcare.6. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dcf0574f-330a-5e57-a3cc-da97fa171f7b",
      "id": "CVE-2026-45669",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3cd5abad-0d2d-54a7-84a1-d12bf3b50855",
      "id": "CVE-2026-46342",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:56e0518f-d946-5703-8052-2c0c10e41325",
      "id": "CVE-2026-47200",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:598e23a1-7585-5cb9-951f-d5798608589d",
      "id": "CVE-2026-53721",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:19eb2b7b-1a4d-5660-b320-cedb52f1f640",
      "id": "CVE-2026-53722",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:deec1a2f-0315-56d8-9043-b7909866bbec",
      "id": "CVE-2026-56326",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:04957132-a9db-50d4-8ed1-29fe3ffeeca7",
      "id": "GHSA-c9cv-mq2m-ppp3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.6 of @nuxt/webpack-builder."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8ec1f088-cbf1-51c1-ab65-a61e0039b72e",
      "id": "GHSA-m3q2-p4fw-w38m",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.6 of @nuxt/webpack-builder. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40nuxt/webpack-builder@3.12.3-tuxcare.6"
    }
  ]
}