{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bb2b207d-92ba-536c-9b04-8215ebc4bf7a", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/tar@1.0.3-tuxcare.2", "type": "library", "name": "tar", "version": "1.0.3-tuxcare.2", "purl": "pkg:npm/tar@1.0.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f53e5070-950e-54cf-9679-20cac188ae4e", "id": "CVE-2015-8860", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-8860 is fixed in version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:40e802eb-894a-5b48-ba6a-be2512574d40", "id": "CVE-2017-20165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-20165 is fixed in version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d736391a-da33-55f9-b46a-b6c7e32ea717", "id": "CVE-2018-20834", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20834 is fixed in version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:805b15f6-0d7b-5182-a4a5-41a6c65dc90c", "id": "CVE-2021-32804", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-32804 is fixed in version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e78909b8-ac40-5a91-a764-9dfe9e2ea4ed", "id": "CVE-2021-37713", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-37713 is fixed in version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:89afecbe-8d1f-550d-9e1d-67fda8f7a09e", "id": "CVE-2024-28863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28863 is fixed in version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:61e117de-dc0b-5b3d-908b-546d9932cfd1", "id": "CVE-2026-23745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-23745 is fixed in version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6ea58a9d-8957-5142-967d-efd21ba1709f", "id": "CVE-2026-23950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-23950 is fixed in version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2b83fa2d-3242-5f12-9cba-753060e01af9", "id": "CVE-2026-24842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24842 is fixed in version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:385bfc81-8c28-576c-a377-17610717b8ef", "id": "CVE-2026-26960", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-26960 is fixed in version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7ea9f5e9-12df-5c2a-ba3f-c0714f7b0c38", "id": "CVE-2026-29786", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29786 affects version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:16fdb4c3-7f85-5a14-af78-e8c2093104ff", "id": "CVE-2026-31802", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-31802 affects version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8c923546-9492-5fbd-a5b6-5ff254a78c00", "id": "CVE-2026-53655", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-53655 does not affect version 1.0.3-tuxcare.2 of tar. not_affected \u2014 The target repository (node-tar v1.0.3-tuxcare.3) is NOT AFFECTED by CVE-2026-53655. While the target is the same product (node-tar) and does parse PAX extended headers, the vulnerability pattern does not exist due to fundamental architectural differences. In v1.0.3, header decoding never receives or applies PAX extended header overrides - metadata entries explicitly receive null for extended p..." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:63690dfa-bb33-52c6-9fcd-16a50e1482c4", "id": "CVE-2026-59871", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59871 does not affect version 1.0.3-tuxcare.2 of tar. not_affected \u2014 CVE-2026-59871 describes a vulnerability in node-tar where PAX header values matching /^[0-9]+$/ are coerced to numbers, causing TypeErrors when .split() is called. This vulnerability does NOT affect version 1.0.3 because it uses field-name-based numeric coercion that explicitly excludes 'path' and 'linkpath' fields. The CVE describes a TypeScript version with value-based regex matching, while ..." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:37d2f1e4-338d-57b1-b09f-31c425c76ba8", "id": "CVE-2026-59873", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59873 affects version 1.0.3-tuxcare.2 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8332e0a9-e790-537a-a611-9f0039c61fec", "id": "CVE-2026-59874", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59874 does not affect version 1.0.3-tuxcare.2 of tar. not_affected \u2014 Target version 1.0.3 does not have the tar.replace() API that contains the vulnerability described in CVE-2026-59874. The replace() function was introduced in later versions (6.x+). The CVE PoC would fail immediately with 'TypeError: tar.replace is not a function' in version 1.0.3." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8b0bcdb4-3341-507e-b717-6a62b5bf98e1", "id": "CVE-2026-59875", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59875 does not affect version 1.0.3-tuxcare.2 of tar. already_fixed \u2014 Version 1.0.3 contains a comprehensive NUL-byte sanitization defense in lib/entry.js (lines 164-168) that strips embedded NUL bytes from both path and linkpath fields before they reach filesystem operations. This defense was added in commit 0444d88 (November 2011) and blocks the CVE-2026-59875 attack vector completely. The target exhibits the upstream fix's behavior using .split(\"\\0\")[0], which..." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:12f2172c-96d8-5097-ae2d-b83bb9cf55e4", "id": "GHSA-r292-9mhp-454m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-r292-9mhp-454m does not affect version 1.0.3-tuxcare.2 of tar. not_affected \u2014 Version 1.0.3 is not affected by GHSA-r292-9mhp-454m. The vulnerability requires the member-selection API (tar.t([files]) or tar.x({...}, [files])) and the filesFilter/mapHas code path, which were introduced in versions after 1.0.3. The vulnerable src/list.ts module with the recursive mapHas helper does not exist in this version." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.2" } ] }