{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:83b2917c-8f74-5d93-9866-d5c2cae05a41", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/handlebars@1.3.0-tuxcare.4", "type": "library", "name": "handlebars", "version": "1.3.0-tuxcare.4", "purl": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c3677184-abdd-5e6e-b1e4-e321f7dac5ee", "id": "CVE-2015-8861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-8861 is fixed in version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:baeaaf76-9c4a-5406-bf3e-7f80c8183546", "id": "CVE-2017-16138", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-16138 is fixed in version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2c4254b5-1959-51bf-b5ce-b9ee68edd73c", "id": "CVE-2019-19919", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-19919 is fixed in version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0ae50a3c-2b68-5ac1-b9fc-571aa9eb0eb5", "id": "CVE-2019-20920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-20920 is fixed in version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4171c3d2-79b1-50c2-8a81-b06b189f2b42", "id": "CVE-2021-23369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23369 is fixed in version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c5389920-ebc6-5246-b8c7-197ec5ae6480", "id": "CVE-2021-23383", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23383 is fixed in version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:50717e2c-6304-5488-b815-8ab1f3e33d2c", "id": "CVE-2025-32014", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32014 is fixed in version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:62d9a561-8efd-5e38-925a-fc25b14d5655", "id": "CVE-2026-33937", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33937 affects version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:315d8964-a8f9-5e92-af57-e09aa803c72f", "id": "CVE-2026-33938", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33938 does not affect version 1.3.0-tuxcare.4 of handlebars. not_affected \u2014 CVE-2026-33938 describes a vulnerability where the @partial-block special variable can be overwritten with a crafted Handlebars AST via helpers, leading to arbitrary JavaScript execution when {{> @partial-block}} is invoked. The target repository (Handlebars 1.3.0) does not have the @partial-block feature at all, as this was introduced in later versions. The specific attack chain described in t..." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4fbbf29f-fd8e-5517-9464-4e9a897ac0e5", "id": "CVE-2026-33939", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33939 does not affect version 1.3.0-tuxcare.4 of handlebars. not_affected \u2014 Handlebars version 1.3.0 is not affected by CVE-2026-33939. The vulnerability concerns decorator invocations ({{*name}} syntax), but decorators were not introduced until Handlebars 3.x+ (2015-2016), years after version 1.3.0's release in January 2014. The target codebase has no decorator support infrastructure: no DecoratorNode in the AST, no decorator visitor methods in the compiler, no decora..." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9b39e98c-9228-5917-9fbe-1b267373381e", "id": "CVE-2026-33940", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33940 does not affect version 1.3.0-tuxcare.4 of handlebars. not_affected \u2014 Handlebars 1.3.0 is not affected by CVE-2026-33940. The vulnerability requires dynamic partial support ({{> (expression)}}) which was added in v3.0.0+. Version 1.3.0 additionally employs constructor validation that rejects plain JavaScript objects from being treated as AST, blocking the typical attack vector where user-controlled JSON data reaches the compiler." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9c108e2c-0996-561e-b40a-6ab39ba73f84", "id": "CVE-2026-33941", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33941 affects version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d23949bb-3a85-595f-861b-7c6ccb74c8c6", "id": "GHSA-2cf5-4w76-r9qv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2cf5-4w76-r9qv is fixed in version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c3faedce-12b9-5648-a0cd-0dbef8fbe522", "id": "GHSA-442j-39wm-28r2", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-442j-39wm-28r2 does not affect version 1.3.0-tuxcare.4 of handlebars. not_affected \u2014 Handlebars version 1.3.0 is not affected by GHSA-442j-39wm-28r2. The vulnerability exists in the container.lookup() function when compat mode is enabled, but this function and compat mode were introduced 7.5 months after v1.3.0 was released. Version 1.3.0 uses a fundamentally different architecture for depth-based template context handling." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:23303622-9909-5aa6-8647-96aa6f9733e6", "id": "GHSA-6r5x-hmgg-7h53", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6r5x-hmgg-7h53 is a false positive for handlebars 1.3.0-tuxcare.4." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3e01383d-eafa-5482-9e94-35a05a215e7b", "id": "GHSA-7rx3-28cr-v5wh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7rx3-28cr-v5wh affects version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1f6ebb37-7710-5edc-b417-7345970cf39c", "id": "GHSA-fmr4-7g9q-7hc7", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fmr4-7g9q-7hc7 is a false positive for handlebars 1.3.0-tuxcare.4." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ad92978f-b94f-55fe-a5f4-4e55a3bbd8c7", "id": "GHSA-g9r4-xpmj-mj65", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-g9r4-xpmj-mj65 is fixed in version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cd5238d2-3cd0-56ae-8d5f-31d73ce0be92", "id": "GHSA-q2c6-c6pm-g3gh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q2c6-c6pm-g3gh is fixed in version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:64920437-7e87-5b3d-8811-2b368e8b1735", "id": "GHSA-q42p-pg8m-cqh6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q42p-pg8m-cqh6 is fixed in version 1.3.0-tuxcare.4 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.4" } ] }