{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:307b2cd1-cd36-5eaa-9403-9cbe4577352b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/tar@1.0.3-tuxcare.1", "type": "library", "name": "tar", "version": "1.0.3-tuxcare.1", "purl": "pkg:npm/tar@1.0.3-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8f331ef5-66bc-557f-b537-5d4ea4f12ef0", "id": "CVE-2015-8860", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-8860 is fixed in version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4c5d76f3-7681-53aa-a4b7-38db23161265", "id": "CVE-2017-20165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-20165 is fixed in version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5a211cbd-14f2-59ed-bae9-a996b5e80c5c", "id": "CVE-2018-20834", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20834 is fixed in version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d61d0d2b-0e82-5cb9-98c9-84f0838b1c19", "id": "CVE-2021-32804", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-32804 is fixed in version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2ffe0f16-910a-5506-914b-d24aedb23b92", "id": "CVE-2021-37713", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-37713 is fixed in version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3351ea9d-9a08-5778-b24f-b721d39d20c8", "id": "CVE-2024-28863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28863 is fixed in version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:03482879-057a-594f-b89d-72ac2386a9bb", "id": "CVE-2026-23745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-23745 affects version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6f697254-c8a3-5ea7-a6e7-17a866f91646", "id": "CVE-2026-23950", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-23950 affects version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:64296472-674a-5d23-9e5c-fd501096433e", "id": "CVE-2026-24842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24842 affects version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:077f1a4a-f9f3-5761-808c-cfbcc995df0a", "id": "CVE-2026-26960", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-26960 affects version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e271fe57-5cb1-5353-ae55-68963db596fa", "id": "CVE-2026-29786", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29786 affects version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:29b4727d-9254-54a4-bd3c-5f627046e450", "id": "CVE-2026-31802", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-31802 affects version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ac73ef1b-81fc-51af-9d36-24c63f2f3ab3", "id": "CVE-2026-53655", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-53655 does not affect version 1.0.3-tuxcare.1 of tar. not_affected \u2014 The target repository (node-tar v1.0.3-tuxcare.3) is NOT AFFECTED by CVE-2026-53655. While the target is the same product (node-tar) and does parse PAX extended headers, the vulnerability pattern does not exist due to fundamental architectural differences. In v1.0.3, header decoding never receives or applies PAX extended header overrides - metadata entries explicitly receive null for extended p..." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4e0046fe-0161-5cd4-9c82-c184fad21d9a", "id": "CVE-2026-59871", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59871 does not affect version 1.0.3-tuxcare.1 of tar. not_affected \u2014 CVE-2026-59871 describes a vulnerability in node-tar where PAX header values matching /^[0-9]+$/ are coerced to numbers, causing TypeErrors when .split() is called. This vulnerability does NOT affect version 1.0.3 because it uses field-name-based numeric coercion that explicitly excludes 'path' and 'linkpath' fields. The CVE describes a TypeScript version with value-based regex matching, while ..." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ff2019cf-e124-58ad-bb66-824c6ba3a8ae", "id": "CVE-2026-59873", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59873 affects version 1.0.3-tuxcare.1 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6bc686df-d5f5-5fcf-aa3e-5a5a7b35771f", "id": "CVE-2026-59874", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59874 does not affect version 1.0.3-tuxcare.1 of tar. not_affected \u2014 Target version 1.0.3 does not have the tar.replace() API that contains the vulnerability described in CVE-2026-59874. The replace() function was introduced in later versions (6.x+). The CVE PoC would fail immediately with 'TypeError: tar.replace is not a function' in version 1.0.3." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:be80b80a-3506-52e8-a260-a85a9ae1fd33", "id": "CVE-2026-59875", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59875 does not affect version 1.0.3-tuxcare.1 of tar. already_fixed \u2014 Version 1.0.3 contains a comprehensive NUL-byte sanitization defense in lib/entry.js (lines 164-168) that strips embedded NUL bytes from both path and linkpath fields before they reach filesystem operations. This defense was added in commit 0444d88 (November 2011) and blocks the CVE-2026-59875 attack vector completely. The target exhibits the upstream fix's behavior using .split(\"\\0\")[0], which..." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:340dbf13-f0ec-58d5-bb7f-4a36f937c8f3", "id": "GHSA-r292-9mhp-454m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-r292-9mhp-454m does not affect version 1.0.3-tuxcare.1 of tar. not_affected \u2014 Version 1.0.3 is not affected by GHSA-r292-9mhp-454m. The vulnerability requires the member-selection API (tar.t([files]) or tar.x({...}, [files])) and the filesFilter/mapHas code path, which were introduced in versions after 1.0.3. The vulnerable src/list.ts module with the recursive mapHas helper does not exist in this version." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.1" } ] }