{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8efbde85-4e9e-5e34-9841-02f6e5ec6a17",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/qs@6.5.3",
      "type": "library",
      "name": "qs",
      "version": "6.5.3",
      "purl": "pkg:npm/qs@6.5.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:9c43c067-429b-5fc6-b26f-2d5957765025",
      "id": "CVE-2026-2391",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-2391 does not affect version 6.5.3 of qs. Version 6.5.3 is not vulnerable. Summary: The target repository (qs v6.5.3-tuxcare.1) is NOT vulnerable to CVE-2026-2391 because it does not contain the comma parsing feature that is affected by this vulnerability. The comma option was introduced in qs v6.10.0, while this repository is running v6.5.3, which predates that feature by several major releases. [terminalized not_affected from patch_application_manual/not_vulnerable]"
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7a425c85-d6b9-512e-9d33-84568674261d",
      "id": "CVE-2026-82417",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-82417 affects version 6.5.3 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a25793ea-cfff-5e30-80e8-aa3777852f51",
      "id": "CVE-2026-8723",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-8723 affects version 6.5.3 of qs."
      },
      "affects": [
        {
          "ref": "pkg:npm/qs@6.5.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/qs@6.5.3"
    }
  ]
}