{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a027d796-a9d6-5c00-8ee2-7fd1e27c3b46", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.12.4-tuxcare.2", "type": "library", "name": "nuxt", "version": "3.12.4-tuxcare.2", "purl": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:982e478f-460f-559a-abec-bcdac684915d", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fd8d24cc-19f7-59f6-9e63-73a3a9f1d751", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b5c5ddcb-449a-5d25-aa9f-4fe1e8c3b8a9", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aa202b9f-e401-5b6f-88b0-a769a8b926e2", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:066b57c2-0a51-58a8-95a0-6569eb46d8b2", "id": "CVE-2025-58751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58751 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f7296e54-c12d-5fe8-9ce6-1fc912b29edd", "id": "CVE-2025-59414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59414 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c5deeebf-7ede-5f0d-b749-49a52bb3fbf5", "id": "CVE-2025-62522", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-62522 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d0f0e78f-997d-5ad6-8dad-3a64f3a1be0d", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:86f6629f-c4fb-5890-ba50-c97605b259ac", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.12.4-tuxcare.2. false_positive \u2014 CVE-2026-42338 is a false positive match for this repository. The CVE concerns the 'ip-address' npm package (specifically XSS vulnerabilities in the Address6 class), but this repository is 'nuxt' (Nuxt.js web framework version 3.12.4-tuxcare.5). Exhaustive search confirmed that the ip-address package is not present in this repository as the project itself, as a vendored/bundled copy, or as a de..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2ef9fd03-3e49-55d2-89bf-1292dff14be7", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f1a96838-8086-5f9c-9055-4eeff8e23e34", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:23c1e088-e343-502f-9e98-bd133ac3a54a", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c098b176-57d3-505e-8e77-7e830c2b05f2", "id": "CVE-2026-53721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:920a9310-b354-54fa-a015-652d6544c905", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a060655b-2539-51b1-947b-e2dd5a5d279c", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5740a2a7-e9a6-5beb-a400-dcaea4452428", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 affects version 3.12.4-tuxcare.2 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7815970b-5a2e-5ceb-9a50-48985267ad3f", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.4-tuxcare.2 of nuxt. not_affected \u2014 Target version (nuxt@3.12.4-tuxcare.5) is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerability was introduced 1754 commits AFTER v3.12.4 when Nuxt upgraded from unhead v1 to v2 in v3.16.0. The target uses a fundamentally different, older implementation that does not contain the vulnerable innerHTML pattern." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.2" } ] }