{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:eeedf24d-d599-58fd-990e-9d839af6f1c1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@vitest/browser",
      "purl": "pkg:npm/%40vitest/browser@2.1.9-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/%40vitest/browser@2.1.9-tuxcare.1",
      "version": "2.1.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "@vitest/browser",
            "purl": "pkg:npm/%40vitest/browser@2.1.9",
            "type": "library",
            "version": "2.1.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-24963",
      "affects": [
        {
          "ref": "pkg:npm/%40vitest/browser@2.1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f5abb800-2b7f-5466-a127-a4c8dbf637b3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-24963 does not affect version 2.1.9-tuxcare.1 of @vitest/browser. not_affected \u2014 CVE-2025-24963 describes an arbitrary file read vulnerability in Vitest's `__screenshot-error` endpoint that accepted a user-controlled `?file=` parameter. The target version 2.1.9 is NOT AFFECTED because upstream fix commit 897863633 (authored by Hiroshi Ogawa, shipped in vanilla 2.1.9 before TuxCare onboarding) already removed this vulnerable pattern. The fix restricts the endpoint to accept ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-112948",
      "affects": [
        {
          "ref": "pkg:npm/%40vitest/browser@2.1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:193f75d4-a20c-563f-bfd1-859721c54620",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-112948 does not affect version 2.1.9-tuxcare.1 of @vitest/browser. not_affected \u2014 Vitest 2.1.9 is not affected by CVE-2026-112948. The vulnerability exists only in Vitest 5.x where code incorrectly overrides server.fs.deny, breaking Vite's default file access protections. Version 2.1.9 does not modify server.fs.deny at all, leaving Vite's default deny list (protecting .env, private keys, .npmrc, etc.) fully active. Additionally, 2.1.9 lacks the API token persistence feature ...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2026-47428",
      "affects": [
        {
          "ref": "pkg:npm/%40vitest/browser@2.1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:313a84b0-5438-5011-a462-f9e733f3329d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47428 affects version 2.1.9-tuxcare.1 of @vitest/browser."
      }
    },
    {
      "id": "CVE-2026-53633",
      "affects": [
        {
          "ref": "pkg:npm/%40vitest/browser@2.1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:90a6e94d-3f3b-5815-9176-b15624989465",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53633 affects version 2.1.9-tuxcare.1 of @vitest/browser."
      }
    },
    {
      "id": "CVE-2026-73653",
      "affects": [
        {
          "ref": "pkg:npm/%40vitest/browser@2.1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f6ec74d5-cfb7-51a0-ae4c-99ae3a2d0a72",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-73653 is fixed in version 2.1.9-tuxcare.1 of @vitest/browser."
      }
    },
    {
      "id": "GHSA-p63j-vcc4-9vmv",
      "affects": [
        {
          "ref": "pkg:npm/%40vitest/browser@2.1.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e4ecac17-d2c4-57db-b9d9-dd7471039ece",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-p63j-vcc4-9vmv affects version 2.1.9-tuxcare.1 of @vitest/browser."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40vitest/browser@2.1.9-tuxcare.1"
    }
  ]
}