{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8268cb6e-73e8-5aec-acf4-80de76ab6202",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/axios@0.24.0",
      "type": "library",
      "name": "axios",
      "version": "0.24.0",
      "purl": "pkg:npm/axios@0.24.0"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:1cfd0152-6684-57ef-bd06-73610c8fca1b",
      "id": "CVE-2024-39338",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-39338 does not affect version 0.24.0 of axios. Target version 0.24.0 is NOT affected by CVE-2024-39338. The vulnerability exists in axios 1.7.2+ which uses the WHATWG URL constructor (new URL()) that resolves protocol-relative URLs. The target uses the legacy Node.js url.parse() API which does not treat '//attacker.com' as protocol-relative, breaking the SSRF attack chain. Testing confirms url.parse('//attacker.com:8888') returns hostname=null (treated as pathname), causing HTTP requests to default to localhost instead of the attacker's server."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.24.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b99c2caa-1400-54aa-a34e-db285fe3b61e",
      "id": "CVE-2026-44492",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44492 affects version 0.24.0 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.24.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3e2084a1-21d3-515a-8c9b-70a7ef843ce2",
      "id": "CVE-2026-44495",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44495 affects version 0.24.0 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.24.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3043194b-9932-5f38-b0e0-fb30671f0f9b",
      "id": "CVE-2026-67316",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-67316 is fixed in version 0.24.0 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.24.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d2ce3aa9-6e47-5d16-ab25-b4340508b9bb",
      "id": "CVE-2026-67319",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-67319 is fixed in version 0.24.0 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.24.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:330cc0ab-0530-5099-9829-447997d78451",
      "id": "GHSA-7q8q-rj6j-mhjq",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.24.0 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.24.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8a0a2dc5-90e1-569f-a949-25c286bb81f3",
      "id": "GHSA-mmx7-hfxf-jppx",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.24.0 of axios."
      },
      "affects": [
        {
          "ref": "pkg:npm/axios@0.24.0"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/axios@0.24.0"
    }
  ]
}