{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:44ec0b03-21e0-5002-b489-997131bfb388", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "@vitejs/plugin-legacy", "purl": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10", "version": "4.5.5-tuxcare.10", "pedigree": { "ancestors": [ { "name": "@vitejs/plugin-legacy", "purl": "pkg:npm/%40vitejs/plugin-legacy@4.5.5", "type": "library", "version": "4.5.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23331", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:850ac6a8-25c3-5ded-bf03-292a4f6d1e4e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23331 does not affect version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy. Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-23331. The fix (adding 'nocase: true' to picomatch options) has been applied and is present in the current codebase." } }, { "id": "CVE-2024-31207", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:e4ab00fb-521e-5a65-8a9c-e500bf3c923f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-31207 does not affect version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy. not_affected - CVE-2024-31207 (server.fs.deny bypass for patterns containing directories) was fixed upstream in vite 5.2.6 / 5.1.7 / 5.0.13 / 4.5.3 / 3.2.10 / 2.9.18. This project version is vite 4.5.5, i.e. above the 4.5.3 fix in the same 4.5.x line, so the fix is already present and no patch is needed. The previous patch_application_error state came from the automation's pre-validation reporting 'Patches already applied'." } }, { "id": "CVE-2024-45811", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:94ff06c3-6234-5f18-b70f-b3b4d3b7a550", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-45811 does not affect version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy. Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-45811. The fix is present in a semantically equivalent form, using `checkServingAccess` with `deniedServingAccessForTransform` instead of the vendor's `ensureServingAccess`, but providing identical protection against the ?import&raw bypass vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2024-52011", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:a0cb7b84-b5b8-5e4d-9861-314ebe21e78f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52011 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2025-24010", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:0ecba1b5-e489-529e-9fa1-e00db55c5fa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24010 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2025-30208", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:03e3292b-0677-59d6-a0e6-76ae703173e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-30208 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2025-31125", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:fc47f0ff-8e60-5eea-990a-e56daf2d7ff8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31125 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2025-31486", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:275c974d-edfd-5325-a882-00e03eab838b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31486 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2025-32395", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:4e39423a-02e7-5b8e-9800-879d01599143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32395 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2025-46565", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:1a5f374c-8022-566d-9ddc-3b7eeb4c6ea8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46565 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2025-58751", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:f459c159-96fb-5d2d-a4ff-fd9a0e29f75e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58751 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2025-58752", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:c36b99d4-b30c-5f31-a829-6079143c3b38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58752 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2025-62522", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:c3c7ca03-d238-5014-82da-c9a3683e173e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62522 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2026-112942", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:fdb3fb2d-cb04-5a79-9a36-3aa3027d6329", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112942 affects version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2026-112943", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:8be69139-8620-51b6-b36a-1711eceeb4d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112943 affects version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2026-112944", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:ab6b2ccf-338e-5f37-ba8d-ca540d160337", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112944 affects version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2026-112945", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:cc91c645-fbec-5bdd-9cdb-8a529ec1913a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112945 affects version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2026-112946", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:e0c0b05c-4c9f-5785-9ad9-47a0f5328a9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112946 does not affect version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy. not_affected \u2014 Version 4.5.5 is not affected by CVE-2026-112946. While the code that adds URLs to `safeModulesPath` exists (importAnalysis.ts:574-576), the security check that would use this set to bypass `fs.allow` restrictions was only introduced in v6.0.0-alpha.10 (commit f684d4cd5, April 2024), after version 4.5.5. Exhaustive search confirms `safeModulesPath` is write-only in version 4.5.5 with no code pa...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-39363", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:995a643e-a4c1-5915-b708-262e2e63ad0e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39363 does not affect version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39363 does not affect Vite 4.5.5. The vulnerability requires fetchModule method and vite:invoke WebSocket event, which were introduced in later versions (5.x/6.x). [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-39364", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:2932f5bb-9092-5a21-b712-8ef79885e32b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39364 does not affect version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy. vite 4.5.5 is outside the affected version range for CVE-2026-39364 per the GitHub Security Advisory and NIST/NVD." } }, { "id": "CVE-2026-39365", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:25d5670d-c275-529a-9326-49cc32ff688a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39365 does not affect version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39365 path traversal vulnerability was present in the original Vite v4.5.5 but has been patched in version 4.5.5-tuxcare.7. The fix (commit 91f0a4f50, backported on 2026-04-20) adds validation to ensure .map file requests for optimized dependencies cannot traverse outside the optimized deps directory via '../' segments in the URL. The target repository currently includes this security patch. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-53571", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:7721a5b4-f8f6-5300-8988-5c2d2e1c7b2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53571 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "CVE-2026-53632", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:aad75678-f4fc-5b63-9277-3b62eb3751af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53632 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "GHSA-4w7w-66w2-5vf9", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:bd7aa020-1fd2-5ffe-afaa-893a9019e76f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4w7w-66w2-5vf9 is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } }, { "id": "GHSA-v2wj-q39q-566r", "affects": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:10ed69c2-5ba6-56f5-8ce7-29225e948251", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-v2wj-q39q-566r is fixed in version 4.5.5-tuxcare.10 of @vitejs/plugin-legacy." } } ], "dependencies": [ { "ref": "pkg:npm/%40vitejs/plugin-legacy@4.5.5-tuxcare.10" } ] }