{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bb88a12f-a662-569c-b75c-9d90d448ec7a", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/nuxt@3.12.4-tuxcare.8", "type": "library", "name": "nuxt", "version": "3.12.4-tuxcare.8", "purl": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:1bd7e006-2953-5817-a82d-ce57737e139d", "id": "CVE-2022-25852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25852 affects version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:246424dc-0cb0-5586-b787-058c36f91708", "id": "CVE-2025-24360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24360 is fixed in version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2256b1a6-fe99-5782-8270-cf2385cfbf37", "id": "CVE-2025-24361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24361 is fixed in version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8a9df2ba-bbbe-56e6-b62e-deb050d736a2", "id": "CVE-2025-27415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27415 affects version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9f034427-aae4-5428-84de-f7a3048b3789", "id": "CVE-2025-58751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58751 affects version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:27e52973-c769-5a52-bddf-658c9bcd2194", "id": "CVE-2025-59414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-59414 affects version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:bcea36a9-fdcd-5e52-af30-9f7f20023029", "id": "CVE-2025-62522", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62522 is fixed in version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:67b9057b-de7f-55a1-96a1-c0717b07b78b", "id": "CVE-2026-41305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41305 is fixed in version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:aa9bc46b-5011-5c6a-a2d0-99b1f455b332", "id": "CVE-2026-42338", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-42338 is a false positive for nuxt 3.12.4-tuxcare.8. false_positive \u2014 CVE-2026-42338 is a false positive match for this repository. The CVE concerns the 'ip-address' npm package (specifically XSS vulnerabilities in the Address6 class), but this repository is 'nuxt' (Nuxt.js web framework version 3.12.4-tuxcare.5). Exhaustive search confirmed that the ip-address package is not present in this repository as the project itself, as a vendored/bundled copy, or as a de..." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fc16e5f7-30b2-5d64-9782-d53acd5ada3d", "id": "CVE-2026-45669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-45669 affects version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:121fdbaa-8b89-5cab-9289-f42c8a8cc5f0", "id": "CVE-2026-46342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-46342 affects version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ac376c4f-2d15-5469-b8bf-672915a88300", "id": "CVE-2026-47200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47200 affects version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9d4f2d21-2ad5-5896-8bbe-41d8c138311b", "id": "CVE-2026-53721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53721 is fixed in version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a7f5af01-cab9-57f3-9a4f-e3771a03ba48", "id": "CVE-2026-53722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53722 affects version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3d246a32-6d38-525b-8f1b-7c94ed34d8a5", "id": "CVE-2026-56326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-56326 affects version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:24631c2a-eba9-5f31-a105-88fc2d90382f", "id": "GHSA-c9cv-mq2m-ppp3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 3.12.4-tuxcare.8 of nuxt." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1a5a55ff-0378-5d6e-887e-2ab5a793230b", "id": "GHSA-m3q2-p4fw-w38m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-m3q2-p4fw-w38m does not affect version 3.12.4-tuxcare.8 of nuxt. not_affected \u2014 Target version (nuxt@3.12.4-tuxcare.5) is NOT affected by GHSA-m3q2-p4fw-w38m. The vulnerability was introduced 1754 commits AFTER v3.12.4 when Nuxt upgraded from unhead v1 to v2 in v3.16.0. The target uses a fundamentally different, older implementation that does not contain the vulnerable innerHTML pattern." }, "affects": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:npm/nuxt@3.12.4-tuxcare.8" } ] }