{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7e86f1cf-fd5f-50d3-b034-7eb8ac0b3961", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/vite@4.5.5-tuxcare.8", "type": "library", "name": "vite", "version": "4.5.5-tuxcare.8", "purl": "pkg:npm/vite@4.5.5-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0ef077f9-9572-5e41-9623-8c0db692a3b8", "id": "CVE-2024-23331", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23331 affects version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2a940be0-bcd4-5763-b749-91e56f538825", "id": "CVE-2024-31207", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-31207 affects version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a9810a5c-35a3-55c3-9687-8656ab4efa99", "id": "CVE-2024-45811", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-45811 does not affect version 4.5.5-tuxcare.8 of vite. Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-45811. The fix is present in a semantically equivalent form, using `checkServingAccess` with `deniedServingAccessForTransform` instead of the vendor's `ensureServingAccess`, but providing identical protection against the ?import&raw bypass vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9c610878-e5f9-5414-b7a5-8e27b145ca96", "id": "CVE-2024-52011", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52011 affects version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:75ec5396-76f8-52d3-ae3c-4e78d714dfa0", "id": "CVE-2025-24010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24010 is fixed in version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:23b9bafb-d39b-53a5-a49a-1b739ca524da", "id": "CVE-2025-30208", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-30208 is fixed in version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b84bc520-9323-5f99-a67e-152701a6ff08", "id": "CVE-2025-31125", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31125 is fixed in version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1812ccb5-7bd5-513b-afa0-9026d6fbd967", "id": "CVE-2025-31486", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31486 is fixed in version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7e0dc4db-4d38-5d77-bb58-a9ef1d7c884b", "id": "CVE-2025-32395", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32395 is fixed in version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c0dced02-34f1-56af-935e-68e5aa2e9da3", "id": "CVE-2025-46565", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46565 is fixed in version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:552fe3a5-d1b5-5324-8de4-dfe61b1784b7", "id": "CVE-2025-58751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58751 affects version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b8340585-7a32-544f-84d0-42322363a302", "id": "CVE-2025-58752", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58752 is fixed in version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:10a8a46c-8f5e-5017-b2b9-3972454f7780", "id": "CVE-2025-62522", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62522 is fixed in version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:09c3e83e-b06d-5092-9545-063db36147f2", "id": "CVE-2026-39363", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39363 does not affect version 4.5.5-tuxcare.8 of vite. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39363 does not affect Vite 4.5.5. The vulnerability requires fetchModule method and vite:invoke WebSocket event, which were introduced in later versions (5.x/6.x). [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3b83da65-066f-5ebe-9816-da93bc9f58ea", "id": "CVE-2026-39364", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-39364 affects version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c6f6ec2f-b100-57c6-aca0-86a64c32fb4f", "id": "CVE-2026-39365", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39365 does not affect version 4.5.5-tuxcare.8 of vite. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39365 path traversal vulnerability was present in the original Vite v4.5.5 but has been patched in version 4.5.5-tuxcare.7. The fix (commit 91f0a4f50, backported on 2026-04-20) adds validation to ensure .map file requests for optimized dependencies cannot traverse outside the optimized deps directory via '../' segments in the URL. The target repository currently includes this security patch. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ba3caafb-1f8c-5219-8f52-6d8f7163152a", "id": "CVE-2026-53571", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53571 affects version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:05ed4b98-dc67-55c1-a436-28a1dcd01289", "id": "CVE-2026-53632", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53632 is fixed in version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:db6dd3ee-1a32-59cc-bc4a-5f8d518b3cde", "id": "GHSA-4w7w-66w2-5vf9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4w7w-66w2-5vf9 is fixed in version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:48f772da-d42d-50f9-904a-5b2404ef83da", "id": "GHSA-v2wj-q39q-566r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-v2wj-q39q-566r is fixed in version 4.5.5-tuxcare.8 of vite." }, "affects": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:npm/vite@4.5.5-tuxcare.8" } ] }