{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4f32e6e9-c610-547e-b649-2886a29e9ee5",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2",
      "type": "library",
      "name": "js-yaml",
      "version": "3.7.0-tuxcare.2",
      "purl": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:c113b5a4-4990-5d8a-9fc4-7c3752b1cbbf",
      "id": "CVE-2025-64718",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64718 is fixed in version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:56c06776-7768-5898-a262-c1aea1d72037",
      "id": "CVE-2026-53550",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53550 affects version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b4cdd923-da53-5222-883b-4ffda5b90666",
      "id": "CVE-2026-59868",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59868 is fixed in version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9b518270-dc73-5069-a869-d5baa1cca123",
      "id": "CVE-2026-59869",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59869 affects version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:14226512-ed96-5350-bd95-696f8bf95fdc",
      "id": "CVE-2026-59870",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59870 affects version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f7413ea1-9b62-5fc0-8294-b6a707f2675b",
      "id": "GHSA-2pr6-76vf-7546",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-2pr6-76vf-7546 is fixed in version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ca4f711f-8271-5814-aa6a-22d34e14d255",
      "id": "GHSA-8j8c-7jfh-h6hx",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-8j8c-7jfh-h6hx is fixed in version 3.7.0-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:327ae4ed-b322-5e0b-ba5a-efd184188584",
      "id": "GHSA-pm4m-ph32-ghv5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-pm4m-ph32-ghv5 does not affect version 3.7.0-tuxcare.2 of js-yaml. not_affected \u2014 js-yaml version 3.7.0 is not affected by GHSA-pm4m-ph32-ghv5. The exponential-time parsing vulnerability described in the CVE relies on a rewind-and-reparse mechanism that does not exist in this version. The code parses flow sequence entries exactly once and reuses the result when they turn out to be keys, resulting in O(n) parsing time rather than the O(2^n) behavior described in the CVE."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/js-yaml@3.7.0-tuxcare.2"
    }
  ]
}