{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b2f4142-a289-5a26-89fa-2839640b8602", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "cross-spawn", "purl": "pkg:npm/cross-spawn@5.1.0-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2", "version": "5.1.0-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5284", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:8ab5ec96-941e-595b-8684-158170a8581d", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-5284 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2020-5284 concerns Next.js (a React framework by ZEIT/Vercel), but the target repository is cross-spawn version 5.1.0 (a Node.js child process spawning utility). This is a wrong-project match with no relationship between the advisory subject and the target codebase." } }, { "id": "CVE-2021-37699", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:a03d4542-d205-5153-a847-85da1460c351", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-37699 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2021-37699 is a Next.js vulnerability (open redirect in error pages) that was incorrectly matched to the cross-spawn repository. Cross-spawn is a Node.js utility for spawning child processes, not a web framework. The affected product (Next.js) has no presence in this repository as the project itself, as vendored code, or as a dependency." } }, { "id": "CVE-2021-43803", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:46e6bb08-e152-5035-8fc8-d0e64cc64753", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43803 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2021-43803 concerns Next.js (a React framework) versions 11.1.0-12.0.5, where invalid or malformed URLs could cause server crashes. The target repository is cross-spawn version 5.1.0, a completely unrelated Node.js utility for spawning child processes cross-platform. This is a wrong-project match - Next.js code is entirely absent from this repository." } }, { "id": "CVE-2022-25883", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b532836c-e0b5-538a-bf74-cf6742d16d78", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-25883 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2022-25883 concerns the semver npm package, not cross-spawn. The target repository (cross-spawn version 5.1.0-tuxcare.1) does not use semver as a dependency and contains no semver code. The provided patch is for cross-spawn 6.0.5 (a different version) and only updates package metadata without fixing the semver vulnerability. This is a wrong-project match." } }, { "id": "CVE-2023-45133", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:2227a0f0-88a7-542d-a83e-ec3eeb0717ed", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-45133 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2023-45133 concerns @babel/traverse, a JavaScript compiler component. The target repository is cross-spawn, a child process spawning utility with no Babel functionality. This is a wrong-project match - the affected component is absent from the entire repository." } }, { "id": "CVE-2023-46298", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:dfde8ecd-4223-5d79-9750-f2e112a8d03d", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-46298 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2023-46298 is a false positive for this repository. The CVE concerns Next.js (a React web framework) and its prefetch response handling, but the target repository is cross-spawn version 5.1.0 (a child process spawning library for Node.js). These are completely different projects with no dependency relationship." } }, { "id": "CVE-2024-21538", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:8ca32dd9-8a0b-5cc8-8ab7-d5268b80a602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-21538 is fixed in version 5.1.0-tuxcare.2 of cross-spawn." } }, { "id": "CVE-2024-43799", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:873f25ca-629f-53aa-9455-6c55ba087688", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-43799 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2024-43799 concerns the 'send' package (HTTP file streaming library), but the target repository is 'cross-spawn' (process spawning utility). These are completely different Node.js packages with no relationship. The CVE advisory was matched to the wrong project." } }, { "id": "CVE-2024-45296", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b7ec5851-4a24-5ced-8d5f-5c6696eeada8", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-45296 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2024-45296 concerns path-to-regexp (pillarjs/path-to-regexp), a path routing library. The target repository is cross-spawn version 5.1.0, a Node.js child process spawning utility. These are entirely different products serving different purposes. Exhaustive containment search found no path-to-regexp code, dependency, or vendored copy in the target repository." } }, { "id": "CVE-2025-14505", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:db1f02ee-46fa-5439-82b0-c093e17eda38", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-14505 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2025-14505 is a wrong-project match. The advisory affects the 'Elliptic' cryptographic package (ECDSA signature generation), but this repository is 'cross-spawn' (a Node.js process spawning utility). No code relationship exists between the two projects." } }, { "id": "CVE-2025-32421", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:1c55af1d-ca4a-5594-877f-7d71c5a336f6", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-32421 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2025-32421 is a wrong-project match. The CVE affects Next.js Pages Router, but the target repository is cross-spawn (a Node.js child process spawning library). These are completely different products with no code relationship." } }, { "id": "CVE-2025-55173", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:42a2208c-7b71-55d5-9dd3-d52c2d123453", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-55173 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2025-55173 is a wrong-project match. The advisory concerns Next.js Image Optimization, but the target repository is cross-spawn (a Node.js child process spawning utility). No Next.js code, image optimization functionality, or related configuration exists in this repository." } }, { "id": "CVE-2025-57752", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:8aeb6b6c-f659-51c8-a1e1-f2788e047ba8", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-57752 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2025-57752 is a false positive for this repository. The CVE concerns Next.js Image Optimization, but this repository is cross-spawn, a Node.js child process spawning utility with no relationship to Next.js." } }, { "id": "CVE-2025-57822", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:d80ff5c7-1107-5b86-8860-fb397bdb3639", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-57822 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2025-57822 is a false positive match. The advisory concerns Next.js Middleware, but the target repository is cross-spawn v5.1.0, a completely different npm package for spawning child processes. No Next.js code, dependencies, or middleware functionality exists in this repository." } }, { "id": "CVE-2026-2739", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:b7885674-12b5-5b19-a7c6-5314451f89aa", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2026-2739 is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 CVE-2026-2739 is a false positive for this repository. The CVE concerns bn.js (a big number library with a maskn() vulnerability), but this repository is cross-spawn (a child process spawning library). The affected component (bn.js) is not present in this repository as the project itself, as a vendored copy, or as a declared dependency." } }, { "id": "GHSA-5c6j-r48x-rmvq", "affects": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ], "bom-ref": "urn:uuid:337c1030-5d72-582a-af8b-244bcfa0f6f7", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-5c6j-r48x-rmvq is a false positive for cross-spawn 5.1.0-tuxcare.2. false_positive \u2014 The CVE GHSA-5c6j-r48x-rmvq concerns the serialize-javascript npm package, which is a JavaScript object serialization library. The target repository is cross-spawn, a child process spawning utility for Node.js. These are completely different packages with unrelated functionality. The Product-Identity Check (Rule 6) confirms: (a) target identity is cross-spawn (process spawning), (b) advisory co..." } } ], "dependencies": [ { "ref": "pkg:npm/cross-spawn@5.1.0-tuxcare.2" } ] }