{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:724f75df-6ff2-5251-b4fd-d4268ecd1a0b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "devalue", "purl": "pkg:npm/devalue@5.8.2-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/devalue@5.8.2-tuxcare.2", "version": "5.8.2-tuxcare.2", "pedigree": { "ancestors": [ { "name": "devalue", "purl": "pkg:npm/devalue@5.8.2", "type": "library", "version": "5.8.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-123561", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:c14e06b6-651f-5430-b279-3ff28f93b3b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123561 affects version 5.8.2-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123562", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:d8a70cce-1ec7-5720-8dc8-879ad7b675ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123562 affects version 5.8.2-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123563", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:7fe64519-3190-51f0-a40c-f8b246ee6b38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123563 affects version 5.8.2-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123564", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:e9798ba9-10d5-5731-be45-f70069aae459", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123564 affects version 5.8.2-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123565", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:8927056a-39fa-5804-804b-ba09d5f3afa0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123565 affects version 5.8.2-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123566", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:99b5ec68-0814-550b-b548-70363ad2025f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-123566 affects version 5.8.2-tuxcare.2 of devalue." } }, { "id": "CVE-2026-123567", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:2caafccf-c230-5130-a95b-f7329be5b36b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123567 does not affect version 5.8.2-tuxcare.2 of devalue. not_affected \u2014 devalue 5.8.2 (target_sha 9ea10cc) already contains the upstream fix for the prototype-injection issue. src/parse.js now rejects a `__proto__` key in both plain-object and null-prototype object deserialization. The fix commit 0623a47 is an upstream commit by Rich Harris. It is part of the upstream release that TuxCare onboarded, because it is an ancestor of the first TuxCare commit.", "justification": "code_not_present" } }, { "id": "CVE-2026-123568", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:1b536675-2596-5c9b-9789-9093f15492a9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123568 does not affect version 5.8.2-tuxcare.2 of devalue. not_affected \u2014 Target is devalue 5.8.2-tuxcare.2, which is newer than the fixed version 5.6.3. The upstream fix, commit 0f04d4d (\"Properly handle __proto__\"), is already in the upstream 5.8.2 release. uneval rejects own '__proto__' keys and emits null-prototype objects with '__proto__:null' placed after the properties, so the prototype pollution does not occur. Because the fix shipped in the upstream release,...", "justification": "code_not_present" } }, { "id": "CVE-2026-123569", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:468a5233-cd13-5314-8c9a-40a519d87714", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-123569 does not affect version 5.8.2-tuxcare.2 of devalue. not_affected \u2014 Target is devalue 5.8.2-tuxcare.2, which is newer than the fixed version 5.6.3. Its stringify and uneval already enumerate only populated array indices and pick a sparse encoding when that is cheaper than per-hole output. Cost is therefore bounded by the number of populated elements, not the declared length. The fix shipped in the upstream release, so this is an upstream fix and not a TuxCare b...", "justification": "code_not_present" } }, { "id": "CVE-2026-81176", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:9c51ebf9-d962-5b80-bdb2-77a61af85e25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-81176 is fixed in version 5.8.2-tuxcare.2 of devalue." } }, { "id": "CVE-2026-92708", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:b11f4d0c-5c3f-5d4a-983b-fbc690093b13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-92708 is fixed in version 5.8.2-tuxcare.2 of devalue." } }, { "id": "GHSA-4q55-j62x-fr9h", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:02534959-f2a8-5d19-bdb1-93142644c575", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4q55-j62x-fr9h is fixed in version 5.8.2-tuxcare.2 of devalue." } }, { "id": "GHSA-hx4r-w6wj-j8fg", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:13c727b2-aa39-53ba-8359-2938c8f40f8c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-hx4r-w6wj-j8fg is fixed in version 5.8.2-tuxcare.2 of devalue." } }, { "id": "GHSA-mcm9-63f2-9j32", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:7b6c0a2e-96c6-554e-b63f-2c0a3d53f3fa", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mcm9-63f2-9j32 is fixed in version 5.8.2-tuxcare.2 of devalue." } }, { "id": "GHSA-r9w8-h9r3-54w4", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:d09708ec-2a80-550c-ac06-e4f7d0daf0b4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-r9w8-h9r3-54w4 is fixed in version 5.8.2-tuxcare.2 of devalue." } }, { "id": "GHSA-wf3x-273g-mvxv", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:4615afdd-8bf1-58d6-bf23-62f64785e71d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wf3x-273g-mvxv is fixed in version 5.8.2-tuxcare.2 of devalue." } }, { "id": "GHSA-x5rw-q4pp-hg5g", "affects": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ], "bom-ref": "urn:uuid:860db024-6ce4-5d8e-8a54-09a018048d8a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x5rw-q4pp-hg5g is fixed in version 5.8.2-tuxcare.2 of devalue." } } ], "dependencies": [ { "ref": "pkg:npm/devalue@5.8.2-tuxcare.2" } ] }