{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:87ef16cf-342a-56ab-b5d4-c03eb8c0c7aa",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "@vitest/browser",
      "purl": "pkg:npm/%40vitest/browser@3.2.7",
      "type": "library",
      "bom-ref": "pkg:npm/%40vitest/browser@3.2.7",
      "version": "3.2.7",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-24963",
      "affects": [
        {
          "ref": "pkg:npm/%40vitest/browser@3.2.7"
        }
      ],
      "bom-ref": "urn:uuid:d05e3553-5da4-5915-b62b-9ec28515d6a1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-24963 does not affect version 3.2.7 of @vitest/browser. not_affected \u2014 CVE-2025-24963 describes an arbitrary file read vulnerability in Vitest's browser mode `__screenshot-error` HTTP handler. The vulnerable code accepted a `file` query parameter directly from user input, allowing attackers to read any file on the filesystem. The target version 3.2.7-tuxcare.2 contains the upstream fix (commit ed9aeba2, shipped in v3.0.4) which replaces the vulnerable `file` param...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-112948",
      "affects": [
        {
          "ref": "pkg:npm/%40vitest/browser@3.2.7"
        }
      ],
      "bom-ref": "urn:uuid:9a7db82e-e2dc-5db3-b548-36c09a690ec1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-112948 does not affect version 3.2.7 of @vitest/browser. not_affected \u2014 Vitest version 3.2.7 is not affected by CVE-2026-112948. The vulnerable code pattern (overriding server.fs.deny in a way that drops Vite's default deny list) is not present in this version. Version 3.2.7 never manipulates server.fs.deny, preserving Vite's default protections for sensitive files (.env, certificates, .npmrc, .git). Additionally, this version does not persist API tokens to a file....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47428",
      "affects": [
        {
          "ref": "pkg:npm/%40vitest/browser@3.2.7"
        }
      ],
      "bom-ref": "urn:uuid:fd1bb9b6-7050-54d7-8b2b-36f06ef85b0c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47428 affects version 3.2.7 of @vitest/browser."
      }
    },
    {
      "id": "CVE-2026-53633",
      "affects": [
        {
          "ref": "pkg:npm/%40vitest/browser@3.2.7"
        }
      ],
      "bom-ref": "urn:uuid:291fcb26-dc60-5517-8af2-ef8f37f021d9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-53633 does not affect version 3.2.7 of @vitest/browser. Target vitest 3.2.7-tuxcare.1 is NOT VULNERABLE to CVE-2026-53633. The CDP (Chrome DevTools Protocol) security fix is present in HEAD. The vulnerable pattern (unguarded CDP API forwarding allowing arbitrary file writes and code execution) has been eliminated by commit 385a1aefd, which adds assertCdpAllowed() permission checks before all CDP operations. However, this fix was authored by upstream contributor Hiroshi Ogawa (hi.ogawa.zz@gmail.com) and was already included in upstream Vitest v3.2.7. TuxCare based their 3.2.7-tuxcare.1 release on this upstream version, inheriting the fix rather than actively backporting it. The fix is a vendor/upstream fix, not a TuxCare backport, as no TuxCare merge commit brought this specific fix into tuxcare-current/3.2.7. Note: TuxCare did create a backport for version 4.0.18 (commit 6f0f32e5d by ddanylov@cloudlinux.com) but not for 3.2.7.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-73653",
      "affects": [
        {
          "ref": "pkg:npm/%40vitest/browser@3.2.7"
        }
      ],
      "bom-ref": "urn:uuid:40f82e0e-bfc1-5e9b-867c-f992981c663e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-73653 affects version 3.2.7 of @vitest/browser."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40vitest/browser@3.2.7"
    }
  ]
}