{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f17c25a6-7b46-521c-8592-55383e8553e5", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5", "type": "library", "name": "@nuxt/kit", "version": "3.12.4-tuxcare.5", "purl": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:364d7964-b7e2-53af-a3b0-9f8a9902ffb1", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:780ef594-6b4d-5962-9ddd-c1067c51cf12", "id": "CVE-2025-24360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24360 is fixed in version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4edd0a8c-4a36-55bf-9ce9-c16d41d214f8", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:41813da0-7e28-51e6-847e-41c3c3079595", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c2f7f0c1-9257-5994-a8ac-76af667a8f49", "id": "CVE-2025-58751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58751 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:89507765-0dc3-510f-9daf-8b2f535bd456", "id": "CVE-2025-59414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59414 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:98b753fe-8193-513c-8c59-f486788cc063", "id": "CVE-2025-62522", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-62522 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:87c1e703-f4dd-51e2-9769-289d81235f71", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6724b13e-0ca9-5e84-a3f8-91f8c0b2bf93", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/kit 3.12.4-tuxcare.5. false_positive \u2014 CVE-2026-42338 is a false positive match for this repository. The CVE concerns the 'ip-address' npm package (specifically XSS vulnerabilities in the Address6 class), but this repository is 'nuxt' (Nuxt.js web framework version 3.12.4-tuxcare.5). Exhaustive search confirmed that the ip-address package is not present in this repository as the project itself, as a vendored/bundled copy, or as a de..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:17b140c0-4710-5c8a-b8bc-418fdd3efd17", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:dc5ef375-f0da-511f-bcb9-98d2181786ff", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1f97553a-3626-598a-8c83-015f0dfba934", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5e9a7090-cdcf-5723-b0d7-1664adcbc280", "id": "CVE-2026-53721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53721 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5dabc693-b3cd-5c67-8ee8-72a58a7da239", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:80978468-c1a4-543f-9a68-ea6c49cd9091", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0ffb8c48-2971-5344-af96-6a0660edb191", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 affects version 3.12.4-tuxcare.5 of @nuxt/kit." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5883e70e-a1b4-5799-9225-1f9d6ebf68cc", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.4-tuxcare.5 of @nuxt/kit. not_affected \u2014 Target version (nuxt@3.12.4-tuxcare.5) is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerability was introduced 1754 commits AFTER v3.12.4 when Nuxt upgraded from unhead v1 to v2 in v3.16.0. The target uses a fundamentally different, older implementation that does not contain the vulnerable innerHTML pattern." }, "affects": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/kit@3.12.4-tuxcare.5" } ] }