{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3dd4f743-07fe-5924-ba5c-60c6283f592c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "create-vite", "purl": "pkg:npm/create-vite@4.5.5-tuxcare.10", "type": "library", "bom-ref": "pkg:npm/create-vite@4.5.5-tuxcare.10", "version": "4.5.5-tuxcare.10", "pedigree": { "ancestors": [ { "name": "create-vite", "purl": "pkg:npm/create-vite@4.5.5", "type": "library", "version": "4.5.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-23331", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:b766b725-9674-55c9-b4e2-780e9827b6ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23331 does not affect version 4.5.5-tuxcare.10 of create-vite. Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-23331. The fix (adding 'nocase: true' to picomatch options) has been applied and is present in the current codebase." } }, { "id": "CVE-2024-31207", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:a6b5cdcd-cb7a-5ead-a54c-25cfc1166301", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-31207 does not affect version 4.5.5-tuxcare.10 of create-vite. not_affected - CVE-2024-31207 (server.fs.deny bypass for patterns containing directories) was fixed upstream in vite 5.2.6 / 5.1.7 / 5.0.13 / 4.5.3 / 3.2.10 / 2.9.18. This project version is vite 4.5.5, i.e. above the 4.5.3 fix in the same 4.5.x line, so the fix is already present and no patch is needed. The previous patch_application_error state came from the automation's pre-validation reporting 'Patches already applied'." } }, { "id": "CVE-2024-45811", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:a8855412-3dca-567b-9d1d-3cc85f69183c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-45811 does not affect version 4.5.5-tuxcare.10 of create-vite. Version 4.5.5 is not vulnerable. Summary: The target repository is NOT vulnerable to CVE-2024-45811. The fix is present in a semantically equivalent form, using `checkServingAccess` with `deniedServingAccessForTransform` instead of the vendor's `ensureServingAccess`, but providing identical protection against the ?import&raw bypass vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2024-52011", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:05622507-dc98-57fa-a4bf-9b8d756acb9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52011 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2025-24010", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:6c54f012-a338-53c1-a86a-faf783588acf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24010 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2025-30208", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:38ac4ad8-e34b-51ca-9f69-d457841d0c3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-30208 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2025-31125", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:2611cf78-25da-55c8-927d-765572bce6ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31125 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2025-31486", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:da83d8ba-2813-573a-83e7-fa0fe4334c22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-31486 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2025-32395", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:25a570e1-8253-5813-ab59-0bb2fe1dfb4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32395 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2025-46565", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:60eeca96-54ca-521c-a29b-8514b66aecad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46565 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2025-58751", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:359249a7-d4f7-50f8-a5be-d64ccda5b881", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58751 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2025-58752", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:f96d8d4c-cddf-5881-99d9-357f13aab02d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58752 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2025-62522", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:825496c7-1643-5fc7-bdd4-f3eb2d680704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62522 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2026-112942", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:2dc8a101-b2e5-5250-be16-5437bd2384f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112942 affects version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2026-112943", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:f4f25a75-27e0-5b85-a90e-74d9ebb142bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112943 affects version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2026-112944", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:4d603e30-3ffb-5e93-83e9-ba6ba5aaa923", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112944 affects version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2026-112945", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:36a4f291-03a4-572a-bfe9-e403ccfc57d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112945 affects version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2026-112946", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:9b292448-f488-5479-a787-bcc4ce2f0cf0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-112946 does not affect version 4.5.5-tuxcare.10 of create-vite. not_affected \u2014 Version 4.5.5 is not affected by CVE-2026-112946. While the code that adds URLs to `safeModulesPath` exists (importAnalysis.ts:574-576), the security check that would use this set to bypass `fs.allow` restrictions was only introduced in v6.0.0-alpha.10 (commit f684d4cd5, April 2024), after version 4.5.5. Exhaustive search confirms `safeModulesPath` is write-only in version 4.5.5 with no code pa...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-39363", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:f3626b14-6aef-5bee-a177-68a525719220", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39363 does not affect version 4.5.5-tuxcare.10 of create-vite. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39363 does not affect Vite 4.5.5. The vulnerability requires fetchModule method and vite:invoke WebSocket event, which were introduced in later versions (5.x/6.x). [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-39364", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:1bb0889f-2815-58a5-8b03-b5ce615875d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39364 does not affect version 4.5.5-tuxcare.10 of create-vite. vite 4.5.5 is outside the affected version range for CVE-2026-39364 per the GitHub Security Advisory and NIST/NVD." } }, { "id": "CVE-2026-39365", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:f0ca3572-e62c-5c48-bd82-d78f57de5299", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39365 does not affect version 4.5.5-tuxcare.10 of create-vite. Version 4.5.5 is not vulnerable. Summary: CVE-2026-39365 path traversal vulnerability was present in the original Vite v4.5.5 but has been patched in version 4.5.5-tuxcare.7. The fix (commit 91f0a4f50, backported on 2026-04-20) adds validation to ensure .map file requests for optimized dependencies cannot traverse outside the optimized deps directory via '../' segments in the URL. The target repository currently includes this security patch. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-53571", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:362c055b-56c6-5f6a-9fd8-ac76c7a51975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53571 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "CVE-2026-53632", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:78ec16a0-27dd-5b91-acb6-cd41010b5cc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53632 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "GHSA-4w7w-66w2-5vf9", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:e354f774-8007-582d-9549-575046e55b89", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4w7w-66w2-5vf9 is fixed in version 4.5.5-tuxcare.10 of create-vite." } }, { "id": "GHSA-v2wj-q39q-566r", "affects": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ], "bom-ref": "urn:uuid:0a6f960e-4c43-5e28-92a5-e3aaf8b26d3d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-v2wj-q39q-566r is fixed in version 4.5.5-tuxcare.10 of create-vite." } } ], "dependencies": [ { "ref": "pkg:npm/create-vite@4.5.5-tuxcare.10" } ] }