{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:11887549-64ed-5cac-b0b7-a0e7f64f2ff2", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2", "type": "library", "name": "@astrojs/rss", "version": "4.16.19-tuxcare.2", "purl": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b81a4f1a-6993-5e56-a4c3-ed6a72c0bbd9", "id": "AIKIDO-2025-10879", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2025-10879 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aed621af-58da-5916-8719-e62178b80c7b", "id": "CVE-2025-55303", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55303 affects version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:90fa761b-ced2-5dc6-bfda-da9d26492500", "id": "CVE-2025-61925", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3fbbf48d-282e-5504-abf5-99d9868c56b7", "id": "CVE-2025-64525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64525 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:373ab976-9e57-5177-b32e-74cd6eff32c4", "id": "CVE-2025-64757", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d366429c-99c2-5aff-adfc-171d87473c37", "id": "CVE-2025-64764", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b5bdba1f-2fa1-543d-83df-2f3077a7a7e8", "id": "CVE-2025-64765", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f45953a4-4777-5f06-b471-edfd3adf03df", "id": "CVE-2025-65019", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8dffbc21-b3ee-5c85-8cc8-574a5c44ba6b", "id": "CVE-2025-66202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7f2e4cf8-b1cc-5225-8485-e4e9db5cf62f", "id": "CVE-2026-33490", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-33490 is a false positive for @astrojs/rss 4.16.19-tuxcare.2. false_positive \u2014 CVE-2026-33490 concerns H3 (a minimal HTTP framework), but the target repository is Astro (a website build tool). H3 is not present in this repository - no vendored code, no dependency, no imports. The only 'h3' references found are HTML heading components (

tags), unrelated to the H3 framework." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aae98e94-8d3c-578b-afb1-06fd30cfc07f", "id": "CVE-2026-33769", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33769 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:46ffba35-aa4e-52ec-993f-e3113584bdfa", "id": "CVE-2026-41067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3356b791-6f93-550d-ac42-67b0dec530e4", "id": "CVE-2026-45028", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45028 affects version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:34c5e3d0-93b7-530e-95fa-df9f0d274816", "id": "CVE-2026-50146", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-50146 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b939cb34-590e-5aba-91e4-8be33f7d206f", "id": "CVE-2026-54298", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e442e78d-73ce-54f7-86b3-b91977dce037", "id": "CVE-2026-54299", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54299 does not affect version 4.16.19-tuxcare.2 of @astrojs/rss. already_fixed \u2014 The target repository has already fixed this vulnerability via CVE-2026-25545 / AIKIDO-2025-10879 (May 7, 2026), which addresses the identical SSRF issue. The fix removes the prerendered error page fetching feature entirely, replacing it with direct SSR rendering. This is a more aggressive mitigation than the upstream's host validation approach." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:24e768ae-2de9-555a-9291-cdf1826f1a75", "id": "CVE-2026-59727", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59727 affects version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cb77e1d6-4d2c-54d4-aaff-2956dc889f44", "id": "CVE-2026-59729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59729 affects version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:61a5dddc-a002-535d-9901-245bed1672df", "id": "GHSA-4g3v-8h47-v7g6", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 affects version 4.16.19-tuxcare.2 of @astrojs/rss." }, "affects": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40astrojs/rss@4.16.19-tuxcare.2" } ] }