{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b9dcec82-6338-5d40-9c5e-8382d7e3f64c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@graphql-tools/utils",
      "purl": "pkg:npm/%40graphql-tools/utils@7.10.0-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/%40graphql-tools/utils@7.10.0-tuxcare.1",
      "version": "7.10.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "@graphql-tools/utils",
            "purl": "pkg:npm/%40graphql-tools/utils@7.10.0",
            "type": "library",
            "version": "7.10.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-104852",
      "affects": [
        {
          "ref": "pkg:npm/%40graphql-tools/utils@7.10.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b34f029e-a245-54b1-8452-6f0957274d4b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-104852 affects version 7.10.0-tuxcare.1 of @graphql-tools/utils, and is fixed in 7.10.0-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-114604",
      "affects": [
        {
          "ref": "pkg:npm/%40graphql-tools/utils@7.10.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:39c75add-41fc-549b-b703-b6cc9bfcda5e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-114604 does not affect version 7.10.0-tuxcare.1 of @graphql-tools/utils. not_affected \u2014 Target version 7.10.0 does not contain the vulnerable code. The `mergeIncrementalResult` function and its vulnerable `setObjectKeyPath` helper were introduced in upstream version 10.10.1 (commit fbb58b51c, dated after version 10.10.0), which is not in HEAD's ancestry. The target repository is based on upstream 7.10.0 with TuxCare maintenance patches, predating the vulnerable feature by approxim...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40graphql-tools/utils@7.10.0-tuxcare.1"
    }
  ]
}