{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d146c9e3-fe95-537e-b324-96bd53a2829d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2", "type": "library", "name": "@astrojs/telemetry", "version": "1.9.2-tuxcare.2", "purl": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5a280716-7747-5c2a-9346-e48f86f94b50", "id": "CVE-2013-7370", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2013-7370 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e254b4cd-539e-56f4-a999-2652ff78d45f", "id": "CVE-2013-7371", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2013-7371 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:929eb43d-4a21-5227-95af-a22c4675d777", "id": "CVE-2018-3717", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3717 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cb416c46-81c7-593f-9dda-200bef28135f", "id": "CVE-2024-56140", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56140 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:77277b80-ca3c-5a26-b391-8b388493aaf7", "id": "CVE-2024-56159", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-56159 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7bee5a35-8592-5170-8686-50b46de8ce19", "id": "CVE-2025-55303", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55303 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:13a0622a-dc41-51de-a969-cfa6d0390ea4", "id": "CVE-2025-61925", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61925 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7ed083f9-dc92-5b5a-8418-46ed72995a9c", "id": "CVE-2025-64757", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64757 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7032d965-2cec-5199-8ee5-39684e6c91dc", "id": "CVE-2025-64764", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64764 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:668facd6-e078-51f7-82cf-b45e5db3fe75", "id": "CVE-2025-64765", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-64765 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:86ae154d-6455-50d9-a563-5bc37e970abd", "id": "CVE-2025-65019", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-65019 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b57f95a0-f6e2-5d30-88bb-92c9eb5fe8be", "id": "CVE-2025-66202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66202 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d6271282-abd2-59de-a23b-5621c71af0cf", "id": "CVE-2026-41067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41067 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3864aa35-427b-5385-b6d6-d92d2a3155fa", "id": "CVE-2026-45028", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45028 affects version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d12441aa-8141-5f06-b32b-3d6d13730240", "id": "CVE-2026-50146", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-50146 affects version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:22047b61-a916-594a-8905-65aa635d97a8", "id": "CVE-2026-54298", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54298 is fixed in version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6bd934a2-2be2-5e67-a6a2-37742a5ae893", "id": "CVE-2026-54299", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-54299 does not affect version 1.9.2-tuxcare.2 of @astrojs/telemetry. not_affected \u2014 Astro version 1.9.2 is not affected by CVE-2026-54299. The vulnerability requires the prerendered error page HTTP fetching feature, which was introduced in Astro 5.12.9+. Version 1.9.2 renders all error pages in-process using the component system, not via HTTP fetch, eliminating the SSRF attack vector." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e8218163-9657-5cf4-920d-364ed3874633", "id": "CVE-2026-59728", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59728 does not affect version 1.9.2-tuxcare.2 of @astrojs/telemetry. not_affected \u2014 Version 2.0.0 of @astrojs/rss does not support the `source` or `enclosure` fields mentioned in CVE-2026-59728. These features were added in a later version (between 2.0.0 and 4.0.19), and the vulnerability was introduced with those features. The current version cannot process RSS feed items with `source.title` or `enclosure.type` fields, making the XML injection vulnerability described in the C..." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:32db1311-70e0-57b0-a895-64a5a141a29f", "id": "CVE-2026-59729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59729 affects version 1.9.2-tuxcare.2 of @astrojs/telemetry." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:29a134c8-89d3-5278-841e-80d0cc87aad6", "id": "GHSA-4g3v-8h47-v7g6", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-4g3v-8h47-v7g6 does not affect version 1.9.2-tuxcare.2 of @astrojs/telemetry. not_affected \u2014 Astro version 1.9.2 does not contain View Transitions functionality. The vulnerable code path (packages/astro/src/runtime/server/transition.ts) does not exist because the View Transitions feature was introduced in a later version (around Astro 2.9+). The vulnerability requires View Transition animation properties to be processed and embedded in generated CSS, but this entire feature is absent f..." }, "affects": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40astrojs/telemetry@1.9.2-tuxcare.2" } ] }