{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:83044e1e-07b3-50a6-9608-8725c187069e",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/qs@6.5.3-tuxcare.1",
      "type": "library",
      "name": "qs",
      "version": "6.5.3-tuxcare.1",
      "purl": "pkg:npm/qs@6.5.3-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:bb6f33b9-40f8-527e-8a27-888376311019",
      "id": "CVE-2020-15366",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-15366 is fixed in version 6.5.3-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.3-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7d198f8a-166c-5606-86d1-1a9470d14b7f",
      "id": "CVE-2025-15284",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-15284 is fixed in version 6.5.3-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.3-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cadd7ec7-8937-54f4-84e9-e8c532df231e",
      "id": "CVE-2026-2391",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-2391 does not affect version 6.5.3-tuxcare.1 of qs. Version 6.5.3 is not vulnerable. Summary: The target repository (qs v6.5.3-tuxcare.1) is NOT vulnerable to CVE-2026-2391 because it does not contain the comma parsing feature that is affected by this vulnerability. The comma option was introduced in qs v6.10.0, while this repository is running v6.5.3, which predates that feature by several major releases. [terminalized not_affected from patch_application_manual/not_vulnerable]"
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.3-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dd9ba481-f43a-5c7d-afe5-3ef9ad1978ab",
      "id": "CVE-2026-8723",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-8723 affects version 6.5.3-tuxcare.1 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.3-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/qs@6.5.3-tuxcare.1"
    }
  ]
}