{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:dcae6452-b82a-52b5-9e75-78e809a2095c",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/hosted-git-info@2.1.5",
      "type": "library",
      "name": "hosted-git-info",
      "version": "2.1.5",
      "purl": "pkg:npm/hosted-git-info@2.1.5"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:7da7b30c-edc9-5f6d-9253-e7608713499d",
      "id": "CVE-2021-23362",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-23362 does not affect version 2.1.5 of hosted-git-info. not_affected \u2014 Version 2.1.5 is not affected by CVE-2021-23362. The vulnerable shortcutMatch regex pattern with nested optional groups was introduced later in v2.3.1 (2017) and fixed in v3.0.8 (2021). Version 2.1.5 (released May 2016) predates the vulnerable code and uses a simpler architecture without the problematic regex."
      },
      "affects": [
        {
          "ref": "pkg:npm/hosted-git-info@2.1.5"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/hosted-git-info@2.1.5"
    }
  ]
}