{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:007bcc9d-eb71-5014-908e-47c73b64d6b3",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/lodash@1.3.1-tuxcare.2",
      "type": "library",
      "name": "lodash",
      "version": "1.3.1-tuxcare.2",
      "purl": "pkg:npm/lodash@1.3.1-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:b0f87f8d-b123-564d-af1f-b80333244ce3",
      "id": "CVE-2018-16487",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-16487 is fixed in version 1.3.1-tuxcare.2 of lodash."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0d306450-9c90-5460-8bc7-c9d88f8f93f3",
      "id": "CVE-2018-3721",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-3721 is fixed in version 1.3.1-tuxcare.2 of lodash."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ea2c34c3-42a8-5e9b-b04e-d42785a8224d",
      "id": "CVE-2019-10744",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2019-10744 is fixed in version 1.3.1-tuxcare.2 of lodash."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:15bc3b5d-48da-581c-b0d2-50697f90a9d0",
      "id": "CVE-2020-8203",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-8203 does not affect version 1.3.1-tuxcare.2 of lodash. lodash version 1.3.1 is not affected by CVE-2020-8203. The vulnerable functions that enable deep property path traversal and assignment (set, setWith, update, updateWith, zipObjectDeep) do not exist in this version. These functions and their underlying infrastructure (baseSet) were introduced in lodash 4.x. The pick function that does exist only performs shallow property copying and cannot be exploited for prototype pollution. Comprehensive testing confirms no pollution is possible in version 1.3.1."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a0b611bc-a2c9-5cf8-acae-f7d3895621c9",
      "id": "CVE-2021-23337",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-23337 is fixed in version 1.3.1-tuxcare.2 of lodash."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e5128973-5b85-5df6-876d-1244c1b57a0a",
      "id": "CVE-2021-23386",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-23386 is fixed in version 1.3.1-tuxcare.2 of lodash."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e58fdb59-2b20-5b6f-8d9d-76d22eedf2aa",
      "id": "CVE-2021-41720",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2021-41720 is a false positive for lodash 1.3.1-tuxcare.2."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bdc315b7-c353-582e-98c2-8172616a8e6e",
      "id": "CVE-2024-21536",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-21536 is fixed in version 1.3.1-tuxcare.2 of lodash."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:95a1b618-ff2d-5746-87e8-084809c37866",
      "id": "CVE-2025-13465",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-13465 does not affect version 1.3.1-tuxcare.2 of lodash. not_affected \u2014 Lodash version 1.3.1 predates the affected version range (4.0.0-4.17.22) and completely lacks the vulnerable code pattern. The baseUnset function and path traversal mechanism that enable CVE-2025-13465's deletion-based prototype pollution do not exist in this version. The _.unset function does not exist at all, and _.omit uses a fundamentally different copy-based implementation rather than path..."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bdfee037-da2d-53eb-a031-61599761e7e7",
      "id": "CVE-2026-2950",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-2950 does not affect version 1.3.1-tuxcare.2 of lodash. not_affected \u2014 lodash 1.3.1 is not affected by CVE-2026-2950. The vulnerability requires path traversal deletion via `baseUnset` function (introduced in lodash 4.x), which allows attackers to pass array-wrapped path segments like `[['constructor'], ['prototype'], ['polluted']]` to delete properties from built-in prototypes. lodash 1.3.1 lacks this entire architecture: no `_.unset` function, no `baseUnset`, no..."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:10555d90-452d-55f5-b60e-611aa547df1d",
      "id": "CVE-2026-4800",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-4800 is fixed in version 1.3.1-tuxcare.2 of lodash."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/lodash@1.3.1-tuxcare.2"
    }
  ]
}