{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7e15f8ab-5e36-56ef-bd5c-de59b8669518",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/lodash@2.3.0",
      "type": "library",
      "name": "lodash",
      "version": "2.3.0",
      "purl": "pkg:npm/lodash@2.3.0"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:3ba676fc-b475-50dc-b990-2fc70cc15132",
      "id": "CVE-2018-16487",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-16487 affects version 2.3.0 of lodash."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@2.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:407550e8-240c-5f68-afa4-1db5c205d955",
      "id": "CVE-2018-3721",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-3721 affects version 2.3.0 of lodash."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@2.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b409b8bf-7357-5a03-988e-a1c649de7297",
      "id": "CVE-2019-10744",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10744 does not affect version 2.3.0 of lodash. Version 2.3.0 is NOT affected by CVE-2019-10744. The vulnerability requires the `defaultsDeep` function, which does not exist in this version (added in v3.x). Furthermore, the underlying `baseMerge` implementation in v2.3.0 has architectural protection that prevents prototype pollution: when merging into non-plain objects like the constructor function, it creates a new empty object (line 1537) rather than traversing into the existing object. Empirical testing confirms the attack fails. The CVE's statement \"versions before 4.17.12 are vulnerable\" is misleading\u2014the vulnerability only affects versions 3.10.x through 4.17.11 where defaultsDeep exists and the code structure allows traversal into constructor.prototype."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@2.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1cfa858e-1420-5578-980e-0b5e889b2651",
      "id": "CVE-2021-23337",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-23337 affects version 2.3.0 of lodash."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@2.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1c997319-3f65-5bc7-8665-6e8240106048",
      "id": "CVE-2021-41720",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2021-41720 is a false positive for lodash 2.3.0."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@2.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:34efbd42-8409-5ca2-b6ca-5e5c3fbca34e",
      "id": "CVE-2025-13465",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-13465 does not affect version 2.3.0 of lodash. not_affected \u2014 Lodash 2.3.0 is not affected by CVE-2025-13465. The vulnerability requires the `_.unset` function and `baseUnset` internal function to perform deletion operations on prototype-polluting paths (__proto__, constructor, prototype). Version 2.3.0 predates the vulnerable code architecture: it has no `_.unset` or `baseUnset` functions. The `_.omit` function exists but uses a fundamentally different i..."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@2.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:036d7bc2-25ec-565f-98f2-1f5d9a14ed28",
      "id": "CVE-2026-2950",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-2950 does not affect version 2.3.0 of lodash. not_affected \u2014 Lodash version 2.3.0 is not affected by CVE-2026-2950. The vulnerability requires the `_.unset` function with path traversal and property deletion capabilities, which were introduced in Lodash 4.x. Version 2.3.0 predates this architecture entirely: it lacks `_.unset`, `baseUnset`, and any path-based property deletion mechanism. The `_.omit` function in 2.3.0 works fundamentally differently\u2014it c..."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@2.3.0"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3775479e-4039-5645-a694-eed75fba4fd6",
      "id": "CVE-2026-4800",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-4800 affects version 2.3.0 of lodash."
      },
      "affects": [
        {
          "ref": "pkg:npm/lodash@2.3.0"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/lodash@2.3.0"
    }
  ]
}