{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c9d7123b-77e6-58ae-8df8-483369f0ed3f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@nuxt/vite-builder",
      "purl": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8",
      "version": "4.0.3-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "@nuxt/vite-builder",
            "purl": "pkg:npm/%40nuxt/vite-builder@4.0.3",
            "type": "library",
            "version": "4.0.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-25852",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:5939e7fb-6fb4-5fd4-be83-65a1396454b7",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-25852 is a false positive for @nuxt/vite-builder 4.0.3-tuxcare.8. CVE-2022-25852 concerns pg-native and libpq (PostgreSQL client libraries for Node.js), but the target repository is Nuxt (a Vue.js meta-framework). Exhaustive containment search found no pg-native/libpq code, no vendored copies, and no dependency relationships. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2025-24360",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:a697c59a-0d5c-5d47-8d1d-7d06e23bf6b3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-24360 does not affect version 4.0.3-tuxcare.8 of @nuxt/vite-builder. not_affected \u2014 CVE-2025-24360 describes a CORS misconfiguration in Nuxt's development server that allowed arbitrary origins (Access-Control-Allow-Origin: *) to access source code. The vulnerability was fixed by upstream commit 7eeb910bf (Daniel Roe, 2025-01-24) which added restrictive CORS configuration limiting access to localhost origins only. This fix was already present in the upstream v4.0.3 release when...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-119198",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4eadc9f6-0d94-5ef0-9b0e-d1e351baebd4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-119198 does not affect version 4.0.3-tuxcare.8 of @nuxt/vite-builder. not_affected \u2014 The target version 4.0.3 is NOT AFFECTED by CVE-2026-119198. The vulnerable dev error reporting feature that accepts client error events via HMR WebSocket and reads arbitrary files was introduced in v4.6.0 (commit 66d6797dd). This version predates that feature entirely. The vulnerable file packages/vite/src/dev-errors.ts does not exist in 4.0.3, and no alternative implementation of the client e...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-119199",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:7fde9c01-36a3-532c-97a9-7092cbff2700",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-119199 affects version 4.0.3-tuxcare.8 of @nuxt/vite-builder, and is fixed in 4.0.3-tuxcare.11."
      }
    },
    {
      "id": "CVE-2026-119201",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:5e7393c5-ff40-5596-b800-fda7e97ded01",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-119201 affects version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "GHSA-534h-c3cw-v3h9",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:42faf1c6-90ea-547f-b485-3a58b17e3ff2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-534h-c3cw-v3h9 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "GHSA-c9cv-mq2m-ppp3",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9977ad47-30b3-58e3-ba46-0d46314359e7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-c9cv-mq2m-ppp3 is fixed in version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    },
    {
      "id": "GHSA-m3q2-p4fw-w38m",
      "affects": [
        {
          "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:a839fb00-11e6-5d98-ab3a-6e71e5dfa4ed",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-m3q2-p4fw-w38m affects version 4.0.3-tuxcare.8 of @nuxt/vite-builder."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40nuxt/vite-builder@4.0.3-tuxcare.8"
    }
  ]
}