{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9bdb6d09-09ce-5a20-b372-7ee74e17de93",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2",
      "type": "library",
      "name": "@vitejs/plugin-legacy",
      "version": "2.9.18-tuxcare.2",
      "purl": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:273e8c97-6d18-5809-af6f-05e15b6ccee1",
      "id": "CVE-2024-23331",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-23331 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:37ddfb7b-c337-56f0-beaf-710db9069f09",
      "id": "CVE-2024-31207",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-31207 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:243ff89d-44fb-566a-95af-2fbf5e814938",
      "id": "CVE-2024-38356",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38356 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:60206cac-d9c5-5a95-ac99-58a27d25dd4e",
      "id": "CVE-2024-45811",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-45811 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9f4fb70e-8cb7-5faf-8fd5-338731d81cbb",
      "id": "CVE-2024-45812",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-45812 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6d8db3a0-2bf7-5a4d-801a-c2b5f43a3ec3",
      "id": "CVE-2024-52011",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-52011 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5dc4a86c-27a3-5f48-a209-05f8b440f670",
      "id": "CVE-2025-24010",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24010 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5282d79d-68a4-51af-ad19-a8eaf2624773",
      "id": "CVE-2025-30208",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-30208 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:35d5b70a-5e6a-5b6e-90ef-7fefd3fe6a04",
      "id": "CVE-2025-31125",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-31125 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4904127c-ed75-5f43-9fe9-de9e40a9d1ac",
      "id": "CVE-2025-31486",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-31486 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d298bc03-a817-567e-9b60-5839afd53a45",
      "id": "CVE-2025-32395",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-32395 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:187abcb4-04ff-5550-8038-64d280f9d001",
      "id": "CVE-2025-46565",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-46565 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5883f620-884f-5f7a-ab84-6402e111d5ff",
      "id": "CVE-2025-58751",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-58751 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:88650367-119d-51d9-a6b7-081326c91b32",
      "id": "CVE-2025-58752",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-58752 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:362ea8e8-af05-5772-842f-bf223b5b71bb",
      "id": "CVE-2025-62522",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-62522 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:de50ae1a-a8c6-595b-a201-198eabb181aa",
      "id": "CVE-2026-39363",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-39363 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3d669720-9017-51ee-8d66-6519d160ce33",
      "id": "CVE-2026-39364",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-39364 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:066147b1-8030-55f6-9d1a-5436f37a7c5e",
      "id": "CVE-2026-39365",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-39365 does not affect version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy. Version 2.9.18 is not vulnerable. Summary: The target Vite 2.9.18-tuxcare.1 repository contains the vulnerable code pattern for CVE-2026-39365 (path traversal in optimized deps .map handler), but the fix has been successfully backported by TuxCare. The mitigation validates that resolved sourcemap paths remain within the optimized deps directory before serving them. [terminalized not_affected from patch_application_manual/not_vulnerable]"
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a61b5ec6-ac66-56a0-85ef-47a6163a8d9f",
      "id": "CVE-2026-53571",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53571 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:eb96c011-31a6-5add-95ba-2ef3c39efec4",
      "id": "CVE-2026-53632",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-53632 is fixed in version 2.9.18-tuxcare.2 of @vitejs/plugin-legacy."
      },
      "affects": [
        {
          "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40vitejs/plugin-legacy@2.9.18-tuxcare.2"
    }
  ]
}