{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:35cf4f82-6fd6-515f-9c85-3260bc6d4028", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1", "type": "library", "name": "@nuxt/schema", "version": "3.2.0-tuxcare.1", "purl": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:530236a6-b7ca-5eb5-9501-a08b14faf0d6", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bb7484ce-4b2c-52ac-92a5-0693b41b9ea3", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c7e3da4f-44bb-5bce-b748-2f4c6bbb6200", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9691fd39-cc4c-5c40-8885-9d2390d9e5f0", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:677189a6-e52a-58ec-9570-1d1517c83a96", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5b74f115-e9cf-5f99-b7fe-0f7f145f5203", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:424da14b-d8a1-5de3-acc2-9a84b2e68c36", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3dfe86a6-113c-5702-9364-480c4b69c8f8", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f258e98b-0add-5a15-8df5-3fc09ef92801", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3ee5e616-0d2c-574b-a76e-b08417c3b714", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:90394b37-2bd8-5922-b684-1f3fa65124cf", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:092c02d6-6a7c-55bb-b962-02cc14edb370", "id": "CVE-2020-8203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-8203 affects version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e72e2c80-a0ef-5c3b-97aa-a37b47753670", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cb9ac442-152d-5d2a-9dc6-934370a6b7f4", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5d847e70-0774-5680-8784-6ee484533b24", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4e40c2fb-9d33-50df-ac8c-e76cdd7b0f87", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:42f697e9-7798-559f-b450-85d2774d7bfd", "id": "CVE-2024-34343", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34343 affects version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:82fe1f96-c848-5650-9a4e-980a51ec0592", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cc6f498c-da11-5836-a6f6-6baf94c8e755", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d16226d7-6ed1-5134-ab9b-5878808b02b6", "id": "CVE-2025-24361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24361 affects version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:12664d02-1fb5-5dc3-8ba6-da53c4003194", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1cb464ff-c06f-5ecf-97cf-77ae87ac732d", "id": "CVE-2026-33151", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33151 affects version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:07b3b43c-ca16-5e59-8c3a-1f5130d0994f", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3e489a01-f911-5d34-9248-d9fcf4abca95", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/schema 3.2.0-tuxcare.1. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2d5fd052-964a-5979-9342-0e9aadec61cd", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b377bde0-4fa3-536a-a6be-9455c2d76f22", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9ddbb987-6ee7-5e04-a676-073cac284158", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.1 of @nuxt/schema. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ea9ca559-dec4-56cc-93c8-4ca40cd6c8ae", "id": "CVE-2026-4800", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-4800 affects version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:88d3996c-afd8-5dac-8ec6-137589598755", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.2.0-tuxcare.1 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:821f40f4-39d2-578c-9302-5fcc2eb47492", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.1 of @nuxt/schema. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:543f661e-4aec-5fb0-b5b7-4b062374926f", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.1 of @nuxt/schema. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:03e24149-0de2-5bf2-a5ab-4c077153abde", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.1 of @nuxt/schema. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.1" } ] }