{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8d587b48-34d3-56e6-8529-8365d6f1d39b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4", "type": "library", "name": "@nuxt/schema", "version": "3.2.0-tuxcare.4", "purl": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:eae34f92-c037-5e1e-93cd-a585d7c8d040", "id": "CVE-2016-10735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-10735 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5af26b40-7f7b-5ef6-b13f-727003b6f697", "id": "CVE-2018-14040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14040 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d1c679d8-e63d-59c0-a7ca-a64d1d3c7bd0", "id": "CVE-2018-14042", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-14042 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:37e4cce8-9241-5d73-a2af-864854dc274a", "id": "CVE-2018-16487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-16487 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:78b99b1f-9ca8-5923-8456-e648eace7fdf", "id": "CVE-2018-20676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20676 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:38364835-76b2-5066-8197-a9f955656a9b", "id": "CVE-2018-20677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20677 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:95a65aad-66ca-5ebd-9942-fb7b7a170645", "id": "CVE-2018-3721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-3721 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0635a8a7-4e5c-57e1-9763-8e72dbe91a3f", "id": "CVE-2019-10744", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-10744 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:aeb8ce6c-7127-5e34-8d0b-9251993943fb", "id": "CVE-2019-14862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-14862 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f99d0557-7711-5b5d-b96d-118ee78fbdcf", "id": "CVE-2019-8331", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-8331 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8c4a4bd6-b207-5591-a9fa-7a5651aba913", "id": "CVE-2020-36049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-36049 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4b6f6d1e-4e08-5a19-b579-7c4d5a2b2ad2", "id": "CVE-2020-8203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-8203 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2a606c7d-9935-5347-86c1-03534546e774", "id": "CVE-2021-23337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23337 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:97726acb-2c22-551b-b120-8643cbafe3e7", "id": "CVE-2022-2421", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2421 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c80bab7a-4e2a-5672-8f7b-d10dd7ec7e52", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:70cbf40d-c601-5e90-a3ac-3846d779a1d7", "id": "CVE-2023-32695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-32695 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6ee069eb-782c-5a3c-8f03-874cd9880815", "id": "CVE-2024-34343", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34343 affects version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:33444428-9d42-51c4-ba92-c3cac76f8a47", "id": "CVE-2024-6484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6484 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f9dbae88-3c57-57db-8e63-9dd6cf602fc1", "id": "CVE-2024-6485", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6485 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d4b60a8a-c5f8-5a27-9272-3429812977a8", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6e0ab6c1-37ce-57b7-aa51-39d9f4bc4e7b", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f40ca3cb-8eab-5c19-98d8-57bf06526033", "id": "CVE-2026-33151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33151 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:439a7ac8-b26b-5498-9dea-579c373b96de", "id": "CVE-2026-41305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41305 affects version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:934bcc69-c67b-583e-a418-46018bfccf09", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for @nuxt/schema 3.2.0-tuxcare.4. false_positive \u2014 CVE-2026-42338 concerns the 'ip-address' npm library (IPv6/IPv4 address parsing), but this repository is Nuxt v3.2.0-tuxcare.1 (a Vue.js meta-framework). The affected component is not present in this repository as a vendored copy, dependency, or in any other form. This is a wrong-project match." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:37a2a5ac-60f8-5d2f-9b50-f5cc58bb63db", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3437e58c-4882-5372-aba0-8078f4b5ffe4", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:46f71d4a-69e9-5c9b-a2ba-66c114fa9270", "id": "CVE-2026-47200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47200 does not affect version 3.2.0-tuxcare.4 of @nuxt/schema. not_affected \u2014 Nuxt version 3.2.0 does not contain the server-only pages feature that is the prerequisite for CVE-2026-47200. The vulnerable code pattern (`.server.vue` pages rendered as islands via `/__nuxt_island/page_*` endpoint) was introduced in Nuxt v3.11.0, which is 2,059 commits after v3.2.0. The target version predates the feature by multiple major versions." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9af0781a-4720-598c-99fa-f48e94b843db", "id": "CVE-2026-4800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-4800 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:eb1cead3-b0ae-5b92-8161-7836af82ffe9", "id": "CVE-2026-53722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53722 is fixed in version 3.2.0-tuxcare.4 of @nuxt/schema." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:38c1e734-fde5-56d0-b7ff-cb188e220bf3", "id": "CVE-2026-56326", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56326 does not affect version 3.2.0-tuxcare.4 of @nuxt/schema. not_affected \u2014 Version 3.2.0 does not contain the vulnerable code pattern. The vulnerability exists in the encodeURL() function which was introduced on June 26, 2024, over a year after version 3.2.0 (released February 9, 2023). The target uses a simpler redirect architecture without the vulnerable encodeURL() function." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d9039441-956a-5b50-aed1-8ea650f2352e", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 does not affect version 3.2.0-tuxcare.4 of @nuxt/schema. not_affected \u2014 Target repository Nuxt version 3.2.0 is NOT affected by GHSA-c9cv-mq2m-ppp3. All three vulnerability sinks described in the CVE (SSR open redirect via path-normalization, script execution via navigateTo open option, and protocol-relative bypass in reloadNuxtApp) require code features that were introduced AFTER version 3.2.0. The vulnerable encodeURL function with WHATWG URL parsing was added in..." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:51eac44c-6cf0-5e1c-a90d-bdaf86d4f287", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.2.0-tuxcare.4 of @nuxt/schema. not_affected \u2014 Version 3.2.0 is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerable innerHTML pattern was introduced in v3.16.0 (March 2025), two years after this version. The target uses noscript.children instead of the vulnerable noscript.innerHTML assignment." }, "affects": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40nuxt/schema@3.2.0-tuxcare.4" } ] }