{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:16e859dd-8cdc-5fe9-b1e2-b6cbdee05d96", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2", "type": "library", "name": "@nuxt/kit", "version": "3.12.3-tuxcare.2", "purl": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:cbe357f6-e7bb-59db-a135-e98a9aa37128", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c14934b5-5bb6-5b54-9326-cbac36f48ebf", "id": "CVE-2024-34343", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34343 is fixed in version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b60a4ecd-13cd-5473-80d6-3cd85b9b03c2", "id": "CVE-2024-34344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-34344 is fixed in version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f64d48a4-2b88-5609-9f13-6e5785ab503b", "id": "CVE-2025-24360", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24360 affects version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e8aa3d79-35d9-517a-9f82-8e1f360e74d2", "id": "CVE-2025-24361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24361 affects version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ff1de435-61e1-514a-8add-a56540dd2a0d", "id": "CVE-2025-27415", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27415 is fixed in version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ce5cf381-b6d1-5743-aa0d-2c09fe9248eb", "id": "CVE-2025-59414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-59414 is fixed in version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e2a6b545-6eda-5b86-987b-1932521fb02f", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ea296565-7f7e-5021-99b4-bda9a131472a", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.12.3-tuxcare.2. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (XSS in Address6 class methods), but this repository is 'nuxt' (a Vue.js framework). The affected component is completely absent from this repository - not as the project itself, not vendored/bundled, and not as any dependency." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:89717b05-378b-528c-9e82-e69ea0de2df2", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5ada0908-6da5-59b9-91c4-b6c861805e24", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e3215137-3b55-57df-b9f9-8149ebb08826", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bdbaafad-0387-51f4-b123-53b7f431cbf2", "id": "CVE-2026-53721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c31d5bbb-d7c5-5275-9ca0-46dc5c4d603d", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f5abf87b-952d-5b25-b8dd-3d556984a8cb", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fc44c6dd-9583-5017-8d6b-d4ef7a463f8a", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 affects version 3.12.3-tuxcare.2 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c40d1984-5043-5632-9469-1c65ec559eb2", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.3-tuxcare.2 of @nuxt/kit. not_affected \u2014 Target version 3.12.3-tuxcare.2 uses a fundamentally different architecture (unhead v1 with server-side data-passing) that does not contain the vulnerable code pattern. The CVE vulnerability (GHSA-m3q2-p4fw-w38m) involves innerHTML usage in client-side DOM manipulation, which was introduced later in version 3.16.0 with the unhead v2 upgrade (March 2025). Version 3.12.3 predates this architectur..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.3-tuxcare.2" } ] }