{
  "@id": "urn:uuid:d2a6ba88-2cac-42f8-92dd-d245f2b62692",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T00:54:00.196261+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/svgo@2.8.4",
          "identifiers": {
            "purl": "pkg:npm/svgo@2.8.4"
          }
        }
      ],
      "timestamp": "2026-10-30T22:33:17.943850+00:00",
      "status_notes": "Vulnerability CVE-2026-29074 affects version 2.8.4 of svgo.",
      "vulnerability": {
        "name": "CVE-2026-29074"
      },
      "action_statement": "Vulnerability CVE-2026-29074 affects version 2.8.4 of svgo."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/svgo@2.8.4",
          "identifiers": {
            "purl": "pkg:npm/svgo@2.8.4"
          }
        }
      ],
      "timestamp": "2026-10-30T22:33:17.943850+00:00",
      "status_notes": "Vulnerability CVE-2026-73650 affects version 2.8.4 of svgo.",
      "vulnerability": {
        "name": "CVE-2026-73650"
      },
      "action_statement": "Vulnerability CVE-2026-73650 affects version 2.8.4 of svgo."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/svgo@2.8.4",
          "identifiers": {
            "purl": "pkg:npm/svgo@2.8.4"
          }
        }
      ],
      "timestamp": "2026-11-04T00:54:00.196261+00:00",
      "status_notes": "Vulnerability CVE-2026-84369 does not affect version 2.8.4 of svgo. not_affected \u2014 The target repository (SVGO v2.8.4) is NOT AFFECTED by CVE-2026-84369. The vulnerability pattern (unfiltered executable HTML content in foreignObject elements) is not present because the upstream fix was already included in the v2.8.4 release that TuxCare onboarded. The fix commit (0557385564a5c6c11d76cd934a6cff94451e532c) was authored by the upstream maintainer Bogdan Chadkin on 2026-08-24, si...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84369"
      },
      "impact_statement": "not_affected \u2014 The target repository (SVGO v2.8.4) is NOT AFFECTED by CVE-2026-84369. The vulnerability pattern (unfiltered executable HTML content in foreignObject elements) is not present because the upstream fix was already included in the v2.8.4 release that TuxCare onboarded. The fix commit (0557385564a5c6c11d76cd934a6cff94451e532c) was authored by the upstream maintainer Bogdan Chadkin on 2026-08-24, si..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/svgo@2.8.4",
          "identifiers": {
            "purl": "pkg:npm/svgo@2.8.4"
          }
        }
      ],
      "timestamp": "2026-10-30T22:33:17.943850+00:00",
      "status_notes": "Vulnerability CVE-2026-84370 affects version 2.8.4 of svgo.",
      "vulnerability": {
        "name": "CVE-2026-84370"
      },
      "action_statement": "Vulnerability CVE-2026-84370 affects version 2.8.4 of svgo."
    }
  ]
}