{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:79103f03-1699-5bc1-b0b1-04e8253f5e3e",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/shell-quote@1.4.3-tuxcare.1",
      "type": "library",
      "name": "shell-quote",
      "version": "1.4.3-tuxcare.1",
      "purl": "pkg:npm/shell-quote@1.4.3-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:817d2ea2-7c5e-5569-a8e0-2ab07caf1bba",
      "id": "CVE-2015-8851",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2015-8851 is fixed in version 1.4.3-tuxcare.1 of shell-quote."
      },
      "affects": [
        {
          "ref": "pkg:npm/shell-quote@1.4.3-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:14eaf05e-bda8-51e1-be45-e1fec559579d",
      "id": "CVE-2016-10541",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2016-10541 is fixed in version 1.4.3-tuxcare.1 of shell-quote."
      },
      "affects": [
        {
          "ref": "pkg:npm/shell-quote@1.4.3-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3a90b2f9-4668-5cfc-b9dc-61df9dd4abfc",
      "id": "CVE-2021-42740",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-42740 does not affect version 1.4.3-tuxcare.1 of shell-quote. Version 1.4.3 is not affected by CVE-2021-42740. The vulnerability exists in the Windows drive letter regex pattern `([A-z]:)?` which incorrectly matches ASCII characters between 'Z' and 'a' (including backtick). This feature was introduced in commit a86bf4f (July 2018) and first released in v1.6.3. Version 1.4.3 predates this feature and does not contain the vulnerable regex pattern. Instead, v1.4.3 directly escapes all shell metacharacters including backtick via the character class at line 60: `/([#!\"$&'()*,:;<=>?@\\[\\\\\\]^`{|}])/g`. The vulnerability was introduced AFTER v1.4.3 was released, making this version immune to CVE-2021-42740."
      },
      "affects": [
        {
          "ref": "pkg:npm/shell-quote@1.4.3-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2a097990-b193-5edd-b0c1-ae959cdd68e0",
      "id": "CVE-2026-13311",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-13311 affects version 1.4.3-tuxcare.1 of shell-quote."
      },
      "affects": [
        {
          "ref": "pkg:npm/shell-quote@1.4.3-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/shell-quote@1.4.3-tuxcare.1"
    }
  ]
}