{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:43ccab2f-ab33-5a1a-8148-654803507703",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/axios@0.21.1",
      "type": "library",
      "name": "axios",
      "version": "0.21.1",
      "purl": "pkg:npm/axios@0.21.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:7538f208-8734-5e86-9ed9-cdfd84916524",
      "id": "CVE-2024-39338",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-39338 does not affect version 0.21.1 of axios. already_fixed \u2014 The target axios 0.21.1-tuxcare.1 already contains equivalent defense logic against CVE-2024-39338 (protocol-relative URL SSRF) through the 'allowAbsoluteUrls' parameter added in CVE-2025-27152 backport (commit bc6d5a0b). When set to false, this parameter forces baseURL concatenation for protocol-relative URLs, preventing SSRF. The defense code exists in the codebase and is reachable on all exe..."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:263dd683-b9b4-5406-a8f5-da45b9af33c8",
      "id": "CVE-2026-44492",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44492 affects version 0.21.1 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7e521628-164d-57bc-b801-10963a19dac1",
      "id": "CVE-2026-44495",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44495 affects version 0.21.1 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8cc14b49-2615-5151-8bb9-9b9add1ad948",
      "id": "CVE-2026-67316",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-67316 is fixed in version 0.21.1 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7bf11a9c-8148-5b21-a266-e4cdecd360bc",
      "id": "CVE-2026-67319",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-67319 is fixed in version 0.21.1 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3c727c1f-0f25-5202-be3f-201f71b83880",
      "id": "GHSA-7q8q-rj6j-mhjq",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.21.1 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b8f29d89-0bd0-561a-931b-182e19c429a1",
      "id": "GHSA-mmx7-hfxf-jppx",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.21.1 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/axios@0.21.1"
    }
  ]
}