{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e4cdc72e-79be-5fe1-a59a-b0547d0db866",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/svelte@1.64.1-tuxcare.1",
      "type": "library",
      "name": "svelte",
      "version": "1.64.1-tuxcare.1",
      "purl": "pkg:npm/svelte@1.64.1-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:0df3e385-df65-577e-9aef-5245797f73be",
      "id": "CVE-2022-25875",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-25875 is fixed in version 1.64.1-tuxcare.1 of svelte."
      },
      "affects": [
        {
          "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0617b196-586d-54a0-a994-7c1e427817b0",
      "id": "CVE-2024-45047",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-45047 is fixed in version 1.64.1-tuxcare.1 of svelte."
      },
      "affects": [
        {
          "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3ded24a6-ae29-51bf-a89d-35dbfdd8f3bb",
      "id": "CVE-2025-15265",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-15265 does not affect version 1.64.1-tuxcare.1 of svelte. not_affected \u2014 Svelte v1.64.1 is not affected by CVE-2025-15265. The vulnerability exists in the `hydratable()` function introduced in Svelte 5.x for async hydration. Version 1.64.1 predates this feature by several major versions and does not contain the vulnerable code path. The SSR implementation in v1.64.1 is compile-time code generation that returns template strings, not a runtime renderer that embeds hyd..."
      },
      "affects": [
        {
          "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:aad6f24b-8fd8-53f7-a376-5aafd26457c1",
      "id": "CVE-2026-27121",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27121 is fixed in version 1.64.1-tuxcare.1 of svelte."
      },
      "affects": [
        {
          "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:eae59339-c977-53cb-8213-158cc20dde5c",
      "id": "CVE-2026-27122",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27122 is fixed in version 1.64.1-tuxcare.1 of svelte."
      },
      "affects": [
        {
          "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3b509093-ae14-5b39-8910-7c30579b30c5",
      "id": "CVE-2026-27125",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27125 is fixed in version 1.64.1-tuxcare.1 of svelte."
      },
      "affects": [
        {
          "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:48506ead-1573-5a04-b878-c1e61afd0302",
      "id": "CVE-2026-27901",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-27901 is fixed in version 1.64.1-tuxcare.1 of svelte."
      },
      "affects": [
        {
          "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:18c17269-912c-5f28-9ac8-7f29cb152435",
      "id": "CVE-2026-42567",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42567 affects version 1.64.1-tuxcare.1 of svelte."
      },
      "affects": [
        {
          "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9978f876-41b1-5344-93b8-d1aba3d3e451",
      "id": "CVE-2026-42573",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42573 does not affect version 1.64.1-tuxcare.1 of svelte. not_affected \u2014 Svelte v1.64.1 is not affected by CVE-2026-42573. The vulnerable code (the `hydratable()` server function that serializes promises into script tags using `.replace()`) does not exist in this version. Svelte v1.64.1 uses a fundamentally different architecture for server-side rendering that does not include promise serialization into hydration scripts."
      },
      "affects": [
        {
          "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f313f7ee-9fd7-5062-b62b-d7d563776956",
      "id": "CVE-2026-42599",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42599 affects version 1.64.1-tuxcare.1 of svelte."
      },
      "affects": [
        {
          "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a2dda74e-44ab-5406-8f39-8582cf9ff63a",
      "id": "GHSA-f3cj-j4f6-wq85",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-f3cj-j4f6-wq85 does not affect version 1.64.1-tuxcare.1 of svelte. not_affected \u2014 Svelte v1.64.1 is not affected by GHSA-f3cj-j4f6-wq85. The vulnerable `hydratable()` function does not exist in this version. This is an old release (2018-2019 era) that predates the introduction of the experimental `hydratable(key, fn)` server-side data serialization feature by several years. While v1.64.1 has a `hydratable` compile option for DOM hydration, this is a completely different feat..."
      },
      "affects": [
        {
          "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/svelte@1.64.1-tuxcare.1"
    }
  ]
}