{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4307e3c3-7615-5815-90ae-2a3b320dff7a",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/js-yaml@3.14.2-tuxcare.1",
      "type": "library",
      "name": "js-yaml",
      "version": "3.14.2-tuxcare.1",
      "purl": "pkg:npm/js-yaml@3.14.2-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:c0006619-4ece-5dcc-ac94-43750637f7e3",
      "id": "CVE-2026-53550",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-53550 affects version 3.14.2-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2b6fb3d8-1864-593d-8438-a94d66221a8d",
      "id": "CVE-2026-59868",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59868 affects version 3.14.2-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b65d8d8e-b129-5bf3-bbbb-a6f5b6679132",
      "id": "CVE-2026-59869",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59869 is fixed in version 3.14.2-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1d8970a7-e2fe-5968-9962-4b8af0051169",
      "id": "CVE-2026-59870",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59870 affects version 3.14.2-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:623c852b-c0ff-5001-8378-afb8228e0ab2",
      "id": "CVE-2026-73643",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-73643 does not affect version 3.14.2-tuxcare.1 of js-yaml. Version 3.14.2 is not affected by CVE-2026-73643. The target uses JavaScript with a direct-parsing architecture, while the vulnerability only exists in TypeScript versions 5.0.0-5.2.2 which use an event-based parser with state snapshots. The vulnerable pattern (state rewinding and re-parsing of flow sequence pair keys) does not exist in version 3.14.2. Empirical testing confirms linear parsing time (3ms for 100 nested levels) versus the exponential behavior described in the CVE."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6433771d-a5eb-5185-86df-2d19e136d697",
      "id": "GHSA-5p4m-2wfm-xmqj",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-5p4m-2wfm-xmqj affects version 3.14.2-tuxcare.1 of js-yaml."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.2-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c1993eed-1f45-59c0-a7ba-f725e4049972",
      "id": "GHSA-pm4m-ph32-ghv5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-pm4m-ph32-ghv5 does not affect version 3.14.2-tuxcare.1 of js-yaml. not_affected \u2014 The target repository (js-yaml 3.14.2-tuxcare.1) does not contain the exponential parsing vulnerability described in GHSA-pm4m-ph32-ghv5. The vulnerability is specific to the event-based parser architecture introduced in later upstream versions, which uses a restoreState + parseNode mechanism that causes O(2^n) re-parsing of nested flow sequence keys. The target uses an older direct-composition..."
      },
      "affects": [
        {
          "ref": "pkg:npm/js-yaml@3.14.2-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/js-yaml@3.14.2-tuxcare.1"
    }
  ]
}