{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:56723d71-0d08-5c14-9a35-252d41ee2f24",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/js-yaml@3.14.1-tuxcare.2",
      "type": "library",
      "name": "js-yaml",
      "version": "3.14.1-tuxcare.2",
      "purl": "pkg:npm/js-yaml@3.14.1-tuxcare.2"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:55a6fbd1-c8b0-59b1-8d55-6d6a74408566",
      "id": "CVE-2025-64718",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-64718 is fixed in version 3.14.1-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a19fde8f-9e33-5524-814e-1fd633ca121c",
      "id": "CVE-2026-53550",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53550 affects version 3.14.1-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dbe9689f-ad84-58db-8ebc-4d33e7162c09",
      "id": "CVE-2026-59868",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59868 affects version 3.14.1-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:feed7a50-a759-529e-bbaf-d2a96bd38303",
      "id": "CVE-2026-59869",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59869 is fixed in version 3.14.1-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fed38664-bd0c-5092-a097-e1b06128955b",
      "id": "CVE-2026-59870",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59870 affects version 3.14.1-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4d160259-ef0e-55e2-9379-02cd3caffdc3",
      "id": "CVE-2026-73643",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73643 does not affect version 3.14.1-tuxcare.2 of js-yaml. Version 3.14.1 is not affected by CVE-2026-73643. The vulnerability exists only in the TypeScript rewrite (versions 5.0.0-5.2.2) where readFlowCollection uses restoreState() to rewind and reparse keys, causing O(2^n) complexity. Version 3.14.1 uses a fundamentally different JavaScript architecture that parses each flow collection element exactly once without backtracking, preventing exponential parsing time. Testing confirmed nested flow pairs parse in milliseconds (would hang in vulnerable versions)."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:69729a50-6019-5de1-b62c-e69c5ac16315",
      "id": "GHSA-5p4m-2wfm-xmqj",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-5p4m-2wfm-xmqj affects version 3.14.1-tuxcare.2 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.1-tuxcare.2"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:eddbf92f-f700-51f0-a846-bb1ff5a967c0",
      "id": "GHSA-pm4m-ph32-ghv5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-pm4m-ph32-ghv5 does not affect version 3.14.1-tuxcare.2 of js-yaml. not_affected \u2014 Target version 3.14.1-tuxcare.2 is NOT affected by GHSA-pm4m-ph32-ghv5. The exponential parsing vulnerability exists only in js-yaml versions >= 5.0.0, <= 5.2.1, which introduced a TypeScript-based event parser architecture with state rewinding. Version 3.14.1 uses a fundamentally different JavaScript-based recursive parsing architecture that lacks the vulnerable restoreState+re-parse pattern. ..."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.1-tuxcare.2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/js-yaml@3.14.1-tuxcare.2"
    }
  ]
}