{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:143b4500-338f-5064-9933-0159b926e383", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3", "type": "library", "name": "@vitejs/plugin-legacy", "version": "4.5.5-tuxcare.3", "purl": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:587c633c-c828-5797-86cc-a52aba3ec5e0", "id": "CVE-2024-23331", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23331 affects version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fcebd63b-4375-5705-81fa-708d22d4d5f0", "id": "CVE-2024-31207", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-31207 affects version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:be0f3a7d-1aad-579e-aee2-b8120d15050f", "id": "CVE-2024-45811", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-45811 does not affect version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy. Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-45811. The fix is present in a semantically equivalent form, using `checkServingAccess` with `deniedServingAccessForTransform` instead of the vendor's `ensureServingAccess`, but providing identical protection against the ?import&raw bypass vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ab4f1ccf-366c-59a8-8862-da6958892bce", "id": "CVE-2024-52011", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52011 affects version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3e516337-e011-58c4-aa5b-246767683e94", "id": "CVE-2025-24010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24010 is fixed in version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b43d52fc-1fd6-56e3-93ac-0bc0b79cbaa4", "id": "CVE-2025-30208", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-30208 is fixed in version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:29d9a2fd-b475-50c9-91f3-1ed674785419", "id": "CVE-2025-31125", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31125 is fixed in version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bf944d2d-ec3b-56dc-bd5c-2b222e6cefd6", "id": "CVE-2025-31486", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31486 is fixed in version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:89a2afb6-efc9-542a-8d68-62c72a94620b", "id": "CVE-2025-32395", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32395 is fixed in version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:00d42195-3be7-5336-a66d-e75e03d62fe6", "id": "CVE-2025-46565", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46565 is fixed in version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f5596454-16fb-585b-b1f2-14cf83ba5fcf", "id": "CVE-2025-58751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58751 affects version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:80d65c19-bbd6-59dc-ae27-f2c142207c11", "id": "CVE-2025-58752", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58752 is fixed in version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:61245220-292e-5f06-9067-21a4f3c41e33", "id": "CVE-2025-62522", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-62522 affects version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2e2f0c33-77ba-5255-9e2b-f78831fad7fe", "id": "CVE-2026-39363", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39363 does not affect version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39363 does not affect Vite 4.5.5. The vulnerability requires fetchModule method and vite:invoke WebSocket event, which were introduced in later versions (5.x/6.x). [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:03286ed6-bf87-5532-89be-7e903b8771af", "id": "CVE-2026-39364", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-39364 affects version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fdf2ff3f-cbce-56e5-83e4-ee98e68eae8a", "id": "CVE-2026-39365", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39365 does not affect version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39365 path traversal vulnerability was present in the original Vite v4.5.5 but has been patched in version 4.5.5-tuxcare.7. The fix (commit 91f0a4f50, backported on 2026-04-20) adds validation to ensure .map file requests for optimized dependencies cannot traverse outside the optimized deps directory via '../' segments in the URL. The target repository currently includes this security patch. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b725a141-44cb-54ec-9b7b-f28f0978943e", "id": "CVE-2026-53571", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53571 affects version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7df6f317-cc3c-5677-9bc2-4d777df51cd1", "id": "CVE-2026-53632", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53632 affects version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:698aafeb-1810-52d3-a92a-686e43f9f6fb", "id": "GHSA-4w7w-66w2-5vf9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-4w7w-66w2-5vf9 affects version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:543baeee-7bb0-5377-95d7-f8c311bb624e", "id": "GHSA-v2wj-q39q-566r", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-v2wj-q39q-566r affects version 4.5.5-tuxcare.3 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.3" } ] }