{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:adb07956-24d2-5fcb-a8c8-db3ff0821498",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/vite@4.5.5-tuxcare.4",
      "type": "library",
      "name": "vite",
      "version": "4.5.5-tuxcare.4",
      "purl": "pkg:npm/vite@4.5.5-tuxcare.4"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:d83bb16f-576d-5537-a899-b29dd1f92655",
      "id": "CVE-2024-23331",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-23331 affects version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:49216c43-d994-5089-a3a6-83dc15b80449",
      "id": "CVE-2024-31207",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-31207 affects version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:81c3199f-5f06-5188-88c1-9de2ed1b2111",
      "id": "CVE-2024-45811",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-45811 does not affect version 4.5.5-tuxcare.4 of vite. Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-45811. The fix is present in a semantically equivalent form, using `checkServingAccess` with `deniedServingAccessForTransform` instead of the vendor's `ensureServingAccess`, but providing identical protection against the ?import&raw bypass vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]"
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:acf8f351-7ee0-5cf7-8b4f-86ef6e953ae7",
      "id": "CVE-2024-52011",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-52011 affects version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f272b164-b34e-52bf-90eb-c5a05bd1f36f",
      "id": "CVE-2025-24010",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-24010 is fixed in version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d11e7e00-85cf-5a28-aaeb-e0b8d4290422",
      "id": "CVE-2025-30208",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-30208 is fixed in version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ce509d75-4cbf-59fc-9d34-7f17f6cdab12",
      "id": "CVE-2025-31125",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-31125 is fixed in version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3b6ef924-4aaf-528d-8a09-6e48ac4e1f59",
      "id": "CVE-2025-31486",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-31486 is fixed in version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7f745ea0-f7a3-5de1-818a-bb924ef35103",
      "id": "CVE-2025-32395",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-32395 is fixed in version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:495476d3-6f97-5a13-9154-b5de9c409f3f",
      "id": "CVE-2025-46565",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-46565 is fixed in version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8da810c3-62a8-5481-b121-35f0418a62f1",
      "id": "CVE-2025-58751",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-58751 affects version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d6d7feb1-14f1-5526-8d71-c5a9612029f9",
      "id": "CVE-2025-58752",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-58752 is fixed in version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:03d377b8-a9e6-5748-b503-3d16576eb2be",
      "id": "CVE-2025-62522",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-62522 affects version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a808a6be-e5e9-50b9-a2d6-90d42823d615",
      "id": "CVE-2026-39363",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-39363 does not affect version 4.5.5-tuxcare.4 of vite. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39363 does not affect Vite 4.5.5. The vulnerability requires fetchModule method and vite:invoke WebSocket event, which were introduced in later versions (5.x/6.x). [terminalized not_affected from patch_application_manual/not_vulnerable]"
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7ab7038c-c285-571a-a073-7884e7c4b2e8",
      "id": "CVE-2026-39364",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-39364 affects version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d9a6c288-2041-54d7-9128-a73b4d73e877",
      "id": "CVE-2026-39365",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-39365 does not affect version 4.5.5-tuxcare.4 of vite. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39365 path traversal vulnerability was present in the original Vite v4.5.5 but has been patched in version 4.5.5-tuxcare.7. The fix (commit 91f0a4f50, backported on 2026-04-20) adds validation to ensure .map file requests for optimized dependencies cannot traverse outside the optimized deps directory via '../' segments in the URL. The target repository currently includes this security patch. [terminalized not_affected from patch_application_manual/not_vulnerable]"
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1e8086fa-b069-57a6-a2b9-649002108a5d",
      "id": "CVE-2026-53571",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53571 affects version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b8bdfe9e-abed-5f67-95dc-5364fe3ef3fa",
      "id": "CVE-2026-53632",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53632 affects version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1b3130fb-2a99-5981-a3fe-bb4b3b1b3b63",
      "id": "GHSA-4w7w-66w2-5vf9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-4w7w-66w2-5vf9 affects version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:915b3ac1-6c5c-5ad7-b65c-d7dbff8120f9",
      "id": "GHSA-v2wj-q39q-566r",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-v2wj-q39q-566r affects version 4.5.5-tuxcare.4 of vite."
      },
      "affects": [
        {
          "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/vite@4.5.5-tuxcare.4"
    }
  ]
}