{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:23b09943-b49c-52d7-994d-b5bf18ca7e1a", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/tar@1.0.3-tuxcare.3", "type": "library", "name": "tar", "version": "1.0.3-tuxcare.3", "purl": "pkg:npm/tar@1.0.3-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:eb080984-92b3-5f65-b0b9-35dae8e71a94", "id": "CVE-2015-8860", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-8860 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:73cecc45-a4ee-50be-987b-bf9781c19a10", "id": "CVE-2017-20165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-20165 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a7f81f27-c686-5a52-a291-87d0bb610796", "id": "CVE-2018-20834", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-20834 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:80580fac-8686-5d18-8c22-10c562d724b4", "id": "CVE-2021-32804", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-32804 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5a3526c9-134f-5d8d-aa27-8bbd61750f99", "id": "CVE-2021-37713", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-37713 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d49063ee-2266-53ba-8ea6-4911b86875a1", "id": "CVE-2024-28863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-28863 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:83fceeb5-9bbf-55dd-a005-625707850c2c", "id": "CVE-2026-23745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-23745 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cf6cc11c-abdf-59db-b298-9531e1decf81", "id": "CVE-2026-23950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-23950 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3922350a-a8a9-5807-9c09-43f4634f725f", "id": "CVE-2026-24842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24842 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7195fd5b-7c04-50d4-afdc-ca20bbcfa18a", "id": "CVE-2026-26960", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-26960 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8be934d7-833c-5342-b683-70bb1002f2ef", "id": "CVE-2026-29786", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29786 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:22fc33c8-6bab-523f-9114-adf32bdf11c3", "id": "CVE-2026-31802", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-31802 is fixed in version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a89c07da-da44-5439-a051-2c0b5ba9931c", "id": "CVE-2026-53655", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-53655 does not affect version 1.0.3-tuxcare.3 of tar. not_affected \u2014 The target repository (node-tar v1.0.3-tuxcare.3) is NOT AFFECTED by CVE-2026-53655. While the target is the same product (node-tar) and does parse PAX extended headers, the vulnerability pattern does not exist due to fundamental architectural differences. In v1.0.3, header decoding never receives or applies PAX extended header overrides - metadata entries explicitly receive null for extended p..." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:50acbc16-5358-5e8b-8b0f-133e69a3f045", "id": "CVE-2026-59871", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59871 does not affect version 1.0.3-tuxcare.3 of tar. not_affected \u2014 CVE-2026-59871 describes a vulnerability in node-tar where PAX header values matching /^[0-9]+$/ are coerced to numbers, causing TypeErrors when .split() is called. This vulnerability does NOT affect version 1.0.3 because it uses field-name-based numeric coercion that explicitly excludes 'path' and 'linkpath' fields. The CVE describes a TypeScript version with value-based regex matching, while ..." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4ef1f155-63f9-54c3-9345-490d7d00ed60", "id": "CVE-2026-59873", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59873 affects version 1.0.3-tuxcare.3 of tar." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cedb26b8-9dd6-5ba7-b415-c33c2717bbac", "id": "CVE-2026-59874", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59874 does not affect version 1.0.3-tuxcare.3 of tar. not_affected \u2014 Target version 1.0.3 does not have the tar.replace() API that contains the vulnerability described in CVE-2026-59874. The replace() function was introduced in later versions (6.x+). The CVE PoC would fail immediately with 'TypeError: tar.replace is not a function' in version 1.0.3." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ed75e4ef-c63f-58fe-9f9d-475bfc3802b1", "id": "CVE-2026-59875", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59875 does not affect version 1.0.3-tuxcare.3 of tar. already_fixed \u2014 Version 1.0.3 contains a comprehensive NUL-byte sanitization defense in lib/entry.js (lines 164-168) that strips embedded NUL bytes from both path and linkpath fields before they reach filesystem operations. This defense was added in commit 0444d88 (November 2011) and blocks the CVE-2026-59875 attack vector completely. The target exhibits the upstream fix's behavior using .split(\"\\0\")[0], which..." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c355c8ad-8c5a-5d59-8f95-145786770cc2", "id": "GHSA-r292-9mhp-454m", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-r292-9mhp-454m does not affect version 1.0.3-tuxcare.3 of tar. not_affected \u2014 Version 1.0.3 is not affected by GHSA-r292-9mhp-454m. The vulnerability requires the member-selection API (tar.t([files]) or tar.x({...}, [files])) and the filesFilter/mapHas code path, which were introduced in versions after 1.0.3. The vulnerable src/list.ts module with the recursive mapHas helper does not exist in this version." }, "affects": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/tar@1.0.3-tuxcare.3" } ] }