{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:db6a87fc-a500-552c-8970-a46db228b0c1", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2", "type": "library", "name": "@vitejs/plugin-legacy", "version": "5.4.21-tuxcare.2", "purl": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:387c57ad-569e-5021-bf67-f0dbfaf4bcd5", "id": "CVE-2025-24010", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-24010 does not affect version 5.4.21-tuxcare.2 of @vitejs/plugin-legacy. already_fixed \u2014 CVE-2025-24010 has been fixed in the target repository. The target (Vite v5.4.21-tuxcare.1) contains all three core defensive mechanisms against the CVE's attack vectors: (1) WebSocket token validation preventing Cross-Site WebSocket Hijacking, (2) Host header validation preventing DNS rebinding attacks, and (3) CORS restrictions limiting cross-origin access. While the CORS implementation diffe..." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e675af5a-65b8-5dc8-b69a-8c592203cbc7", "id": "CVE-2025-46565", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-46565 does not affect version 5.4.21-tuxcare.2 of @vitejs/plugin-legacy. already_fixed \u2014 The target repository vite@5.4.21-tuxcare.1 already contains the fix for CVE-2025-46565. The vulnerability (bypassing server.fs.deny patterns using /.env/. style paths) was addressed in commit 766947e7c on April 30, 2025, which is an ancestor of the current HEAD (5e772c54d)." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:89b975de-a038-5c33-8a2e-646fcb30692c", "id": "CVE-2025-58751", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58751 does not affect version 5.4.21-tuxcare.2 of @vitejs/plugin-legacy. already_fixed \u2014 The target Vite 5.4.21-tuxcare.1 already contains the complete fix for CVE-2025-58751. The upstream Vite v5.4.21 release included both critical patches: the sirv@2.0.4 library patch that enforces directory path separator validation to prevent prefix confusion attacks, and the HTML middleware enhancements that add filesystem access checks. These fixes prevent path traversal attacks that could by..." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f0396bcb-630b-5cd7-90b4-f63cc6d55805", "id": "CVE-2025-58752", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58752 does not affect version 5.4.21-tuxcare.2 of @vitejs/plugin-legacy. already_fixed \u2014 The target repository (Vite 5.4.21-tuxcare.1) already contains the fix for CVE-2025-58752. The vulnerability allowed arbitrary HTML files on the filesystem to be served regardless of server.fs allow/deny settings. The fix was introduced in upstream Vite v5.4.20 (commit 482000f57) and is present in the target version." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:041ff24d-988c-566f-b1d3-db06fb02f6d4", "id": "CVE-2025-62522", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-62522 does not affect version 5.4.21-tuxcare.2 of @vitejs/plugin-legacy. already_fixed \u2014 CVE-2025-62522 has already been fixed in the target repository. The fix commit cad1d31d0 ('fix(dev): trim trailing slash before `server.fs.deny` check') is an ancestor of the target SHA 5e772c54d, and the defense logic is present in the code at packages/vite/src/node/server/middlewares/static.ts lines 262-267." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e734cf58-5328-5e2e-a5ef-ba7800431c0f", "id": "CVE-2026-39363", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39363 does not affect version 5.4.21-tuxcare.2 of @vitejs/plugin-legacy. not_affected \u2014 The target version (Vite 5.4.21-tuxcare.1) is not affected by CVE-2026-39363. The vulnerability exploits the Environment API architecture (DevEnvironment class, HotChannel interface, and vite:invoke WebSocket protocol) that was introduced in Vite 5.5+. Version 5.4.21 uses an older architecture where these components do not exist." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5bbfd8b1-6a09-5ed9-a085-c0a1483f4102", "id": "CVE-2026-39364", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39364 does not affect version 5.4.21-tuxcare.2 of @vitejs/plugin-legacy. not_affected \u2014 The target version (Vite 5.4.21) is not affected by CVE-2026-39364. While the CVE affects versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4, the target uses a fundamentally different architecture for access control that includes automatic query parameter stripping before deny-list pattern matching, preventing the vulnerability mechanism from manifesting." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8dfe0673-486d-55b9-acc8-253e893b453d", "id": "CVE-2026-39365", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-39365 is fixed in version 5.4.21-tuxcare.2 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b5e7e851-b61d-5327-a5e5-7d0f27f01baf", "id": "CVE-2026-53571", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53571 affects version 5.4.21-tuxcare.2 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:10b13b2f-5b95-5d4c-ab1f-0da568fce26a", "id": "CVE-2026-53632", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53632 affects version 5.4.21-tuxcare.2 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@5.4.21-tuxcare.2" } ] }