{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f8d305af-2287-5dd0-b98e-2bfbad12a672", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9", "type": "library", "name": "@vitejs/plugin-legacy", "version": "4.5.5-tuxcare.9", "purl": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:fd273fbb-d0f1-50c5-99d1-ad6bccf6c3d9", "id": "CVE-2024-23331", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23331 does not affect version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy. Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-23331. The fix (adding 'nocase: true' to picomatch options) has been applied and is present in the current codebase." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:607c234d-fee3-547a-9e7c-5deac077c9e5", "id": "CVE-2024-31207", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-31207 does not affect version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy. not_affected - CVE-2024-31207 (server.fs.deny bypass for patterns containing directories) was fixed upstream in vite 5.2.6 / 5.1.7 / 5.0.13 / 4.5.3 / 3.2.10 / 2.9.18. This project version is vite 4.5.5, i.e. above the 4.5.3 fix in the same 4.5.x line, so the fix is already present and no patch is needed. The previous patch_application_error state came from the automation's pre-validation reporting 'Patches already applied'." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c2fd3ea1-f398-52a1-aff2-b098692dbfc0", "id": "CVE-2024-45811", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-45811 does not affect version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy. Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-45811. The fix is present in a semantically equivalent form, using `checkServingAccess` with `deniedServingAccessForTransform` instead of the vendor's `ensureServingAccess`, but providing identical protection against the ?import&raw bypass vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5f8b4a3e-51ba-55dc-814b-6b63e8f5990c", "id": "CVE-2024-52011", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52011 affects version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:4d4ed8fc-3a48-5396-b23a-9b9f49498a75", "id": "CVE-2025-24010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24010 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fd7e2e03-e249-5384-a7c6-ec2769d1584f", "id": "CVE-2025-30208", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-30208 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:dc637a48-3e90-502e-9274-38795d731e7b", "id": "CVE-2025-31125", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31125 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:16874f9c-3a31-5165-9ca7-26224aaa7854", "id": "CVE-2025-31486", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31486 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5dc9796f-39e2-5bb3-bf76-92e7a26fef25", "id": "CVE-2025-32395", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32395 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d19f4830-c85b-5340-9621-a64a3d929740", "id": "CVE-2025-46565", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46565 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2d7af8dc-24c7-5480-96f5-1d131572ee6a", "id": "CVE-2025-58751", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58751 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:4d8da7d8-6730-54e1-8d41-149364cb0abb", "id": "CVE-2025-58752", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58752 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3d649682-a986-50a0-82d5-707b5c13a851", "id": "CVE-2025-62522", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62522 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:4d954b06-740d-5386-9e2d-00d5ebee8cdf", "id": "CVE-2026-39363", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39363 does not affect version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39363 does not affect Vite 4.5.5. The vulnerability requires fetchModule method and vite:invoke WebSocket event, which were introduced in later versions (5.x/6.x). [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:af405c3c-ee60-57dd-8cf2-a830fd4ed67d", "id": "CVE-2026-39364", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39364 does not affect version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy. vite 4.5.5 is outside the affected version range for CVE-2026-39364 per the GitHub Security Advisory and NIST/NVD." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e45f832d-bf65-5826-9449-3b3ec3e33c1f", "id": "CVE-2026-39365", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39365 does not affect version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39365 path traversal vulnerability was present in the original Vite v4.5.5 but has been patched in version 4.5.5-tuxcare.7. The fix (commit 91f0a4f50, backported on 2026-04-20) adds validation to ensure .map file requests for optimized dependencies cannot traverse outside the optimized deps directory via '../' segments in the URL. The target repository currently includes this security patch. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:8c9546dc-a282-55b5-a645-03af230be13c", "id": "CVE-2026-53571", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53571 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fa8150b8-f29a-538b-bbd3-4904e0cd379a", "id": "CVE-2026-53632", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53632 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:fb9413ac-05f6-5962-8f82-95f6e0046acb", "id": "GHSA-4w7w-66w2-5vf9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4w7w-66w2-5vf9 is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:1af30462-3f47-5e40-afe5-56ce0072d811", "id": "GHSA-v2wj-q39q-566r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-v2wj-q39q-566r is fixed in version 4.5.5-tuxcare.9 of @vitejs/plugin-legacy." }, "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] } ], "dependencies": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.9" } ] }