{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4baa5c47-d652-5d76-89e1-5ade7081a5d5", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.12.3-tuxcare.5", "type": "library", "name": "nuxt", "version": "3.12.3-tuxcare.5", "purl": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:372466f1-80b5-5dc6-90ff-dbffe88c0508", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b74e1163-25a4-538e-899d-4075e2ef5653", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8173f0d0-69d3-5341-81d7-2e2fe5545259", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d021c924-365f-55f2-9224-5a1d4cd458b5", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:37a0f63f-665e-5972-be3c-6156bfdef5dd", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5140f4d2-23c3-5e32-83f2-fdee6d5cd07f", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b6059a00-4312-5b94-a953-adaa94f6ca86", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5a20d184-d2cd-5493-b32e-3e9fa5dc468f", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2bb0773b-f64e-5950-adc2-c4990cebd288", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.12.3-tuxcare.5. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7897f068-8a33-56db-a17d-3f74fcac8d23", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b3e1b209-c1fe-58e2-b170-a5efc68d78db", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:43b313a7-ad16-552f-8b9d-19ff38d27946", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7e42cc84-4467-5067-adc0-06a19887e3a8", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:52a9f46b-4243-5d69-8a15-76e506c9d7f1", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ecfafad7-37e8-5718-b059-6b0d2f47e0b9", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2f68951e-5f30-5e50-b07a-bbd294e192a9", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.3-tuxcare.5 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:816cc92a-c75b-59a9-ac55-17c7d7d7ac7a", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.5 of nuxt. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.12.3-tuxcare.5" } ] }