{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:39236e10-93d6-5424-890f-59d071e0af64", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1", "type": "library", "name": "@nuxt/kit", "version": "3.12.3-tuxcare.1", "purl": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8ff0fe40-a814-56f4-a63e-fba6bd20858c", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b021cec3-addc-5b20-8847-1dfdd0b0d232", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5c22334f-6f7e-5f15-9f23-24ff1c28b91a", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a095361f-421f-5b1a-9898-7559ca788462", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:02c19db2-8a8a-5d0d-904c-726c3894b3f9", "id": "CVE-2025-24361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24361 affects version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e802fab5-464a-5555-a74e-7baa8ce6a117", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ea967366-a351-5059-8ae0-2339280c375e", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ae68dd50-4fa1-53dd-8749-8ffb36b4cdab", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:775e3aff-e88b-5b27-9182-7707bffaa508", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.12.3-tuxcare.1. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ad7d3a00-1ccb-53b7-96e4-0954b1f067af", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dbe39682-768b-526b-8544-b231b75f6885", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:23c42a87-7572-5e94-a464-8229c09c8a6e", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:680e03cd-76b9-58b3-8c91-d4f697a15b1a", "id": "CVE-2026-53721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d431aa73-688c-578a-84d6-b8f3e1123e47", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:df978890-91f3-5ae7-9838-7b4c58f5c8cd", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:51a3f6f6-fe99-59c0-ba79-1806478a6ec7", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 affects version 3.12.3-tuxcare.1 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3eacd4d9-46d5-53f7-94c7-ea1dfa0aef08", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.1 of @nuxt/kit. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.1" } ] }