{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c7a3f7c6-441a-5500-bb22-66b0b10a5320",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@babel/standalone",
      "purl": "pkg:npm/%40babel/standalone@7.29.8",
      "type": "library",
      "bom-ref": "pkg:npm/%40babel/standalone@7.29.8",
      "version": "7.29.8",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-44728",
      "affects": [
        {
          "ref": "pkg:npm/%40babel/standalone@7.29.8"
        }
      ],
      "bom-ref": "urn:uuid:549f9a74-d6c0-5b88-94c6-99986950b6d4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-44728 does not affect version 7.29.8 of @babel/standalone. CVE-2026-44728 affects @babel/plugin-transform-modules-systemjs when handling string-literal module names (e.g., export {foo as \"default exports\"}). The vulnerability caused Babel to generate syntactically invalid JavaScript that could be exploited for code injection. The target repository (babel v7.29.8) is NOT AFFECTED because the upstream vendor fix (commit 32ebd5aaf2) is already present in the codebase. The fix was authored by upstream Babel maintainer Hu\u00e1ng J\u00f9nli\u00e0ng (jlhwung@gmail.com) on May 5, 2026, and correctly implements the computed member expression flag to generate bracket notation for string module names.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40babel/standalone@7.29.8"
    }
  ]
}