{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4b48b4cd-b47c-5f7f-a9c4-f5cb8c336d66", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1", "type": "library", "name": "@astrojs/telemetry", "version": "1.9.2-tuxcare.1", "purl": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:10cf30a8-4975-5baf-8471-16da94382dae", "id": "CVE-2013-7370", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2013-7370 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:338fd7e9-a0d2-543e-942b-65ac6e5f7f55", "id": "CVE-2013-7371", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2013-7371 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:caf4bef3-9ef9-5d7b-8721-c2ae4b212ac3", "id": "CVE-2018-3717", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3717 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2b4a7272-1667-5f00-afbd-a408ee1dbd77", "id": "CVE-2024-56140", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:07224412-d701-5029-8893-d655348aa950", "id": "CVE-2024-56159", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a174adba-988f-5c1c-a832-22f85906bd64", "id": "CVE-2025-55303", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:62a277ba-e57e-53b8-8868-63735f631f55", "id": "CVE-2025-61925", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6f9cb388-4105-5b53-a951-551c22e5061d", "id": "CVE-2025-64757", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:45d253af-12da-5c3d-af1b-baf1c9934586", "id": "CVE-2025-64764", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e2b3cc69-8453-5891-940e-ecbc958f4d9c", "id": "CVE-2025-64765", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:eba0069c-6392-5c1d-b11a-50f04eb2ac72", "id": "CVE-2025-65019", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3502ab06-d470-55cc-b5a2-e9c71df0466e", "id": "CVE-2025-66202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4b46b1dd-8188-5d19-82f6-19e03c0df0b4", "id": "CVE-2026-41067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c956ddff-6490-529c-a825-9a676c94f4c7", "id": "CVE-2026-45028", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45028 affects version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d94ec790-916a-5b58-bcfc-da85ad44b73a", "id": "CVE-2026-50146", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50146 affects version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:124c3dcd-eaba-5f09-80e3-40a454ab7ca6", "id": "CVE-2026-54298", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-54298 affects version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d2b7835b-fca1-5171-aaf9-0e56dbd9d1c2", "id": "CVE-2026-54299", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54299 does not affect version 1.9.2-tuxcare.1 of @astrojs/telemetry. not_affected \u2014 Astro version 1.9.2 is not affected by CVE-2026-54299. The vulnerability requires the prerendered error page HTTP fetching feature, which was introduced in Astro 5.12.9+. Version 1.9.2 renders all error pages in-process using the component system, not via HTTP fetch, eliminating the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:02981807-8afc-5bb5-9d65-c902c29dc6dd", "id": "CVE-2026-59728", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59728 does not affect version 1.9.2-tuxcare.1 of @astrojs/telemetry. not_affected \u2014 Version 2.0.0 of @astrojs/rss does not support the `source` or `enclosure` fields mentioned in CVE-2026-59728. These features were added in a later version (between 2.0.0 and 4.0.19), and the vulnerability was introduced with those features. The current version cannot process RSS feed items with `source.title` or `enclosure.type` fields, making the XML injection vulnerability described in the C..." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:60da3a0e-4579-5729-8499-d36588698fd9", "id": "CVE-2026-59729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59729 affects version 1.9.2-tuxcare.1 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:26fd68fe-019b-5c2b-9e00-1fe921c202d6", "id": "GHSA-4g3v-8h47-v7g6", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 does not affect version 1.9.2-tuxcare.1 of @astrojs/telemetry. not_affected \u2014 Astro version 1.9.2 does not contain View Transitions functionality. The vulnerable code path (packages/astro/src/runtime/server/transition.ts) does not exist because the View Transitions feature was introduced in a later version (around Astro 2.9+). The vulnerability requires View Transition animation properties to be processed and embedded in generated CSS, but this entire feature is absent f..." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.1" } ] }