{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8dcfd425-b0bd-5557-849c-fb3ab3c09415",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "handlebars",
      "purl": "pkg:npm/handlebars@3.0.8-tuxcare.4",
      "type": "library",
      "bom-ref": "pkg:npm/handlebars@3.0.8-tuxcare.4",
      "version": "3.0.8-tuxcare.4",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2015-8861",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1af60797-adb7-52bb-bd3b-1fb97864978b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2015-8861 is fixed in version 3.0.8-tuxcare.4 of handlebars."
      }
    },
    {
      "id": "CVE-2021-23369",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:031c6a0a-5d14-516c-9365-cc2cffc5a5e7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-23369 is fixed in version 3.0.8-tuxcare.4 of handlebars."
      }
    },
    {
      "id": "CVE-2021-23383",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:62673233-8611-5f35-83bd-72ec1461529b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-23383 is fixed in version 3.0.8-tuxcare.4 of handlebars."
      }
    },
    {
      "id": "CVE-2026-106445",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d44eb320-bc51-5f02-9b82-255608ff901b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-106445 is fixed in version 3.0.8-tuxcare.4 of handlebars."
      }
    },
    {
      "id": "CVE-2026-33916",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c302ef88-9267-5a4e-9a56-727d81d2715e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-33916 is fixed in version 3.0.8-tuxcare.4 of handlebars."
      }
    },
    {
      "id": "CVE-2026-33937",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:267f6d4c-eb2a-53dd-9c8b-26777afa0e46",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-33937 is fixed in version 3.0.8-tuxcare.4 of handlebars."
      }
    },
    {
      "id": "CVE-2026-33938",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c3fb8632-b402-50a0-8913-bc19f1f14bf8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-33938 does not affect version 3.0.8-tuxcare.4 of handlebars. not_affected \u2014 Handlebars version 3.0.8 is not affected by CVE-2026-33938 because the @partial-block feature targeted by this vulnerability does not exist in this version. The @partial-block functionality was introduced in version 4.x (commit 94c840b 'Create data frame for @partial-block') and is not present in the 3.0.8 codebase.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-33939",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f324d3e7-8d69-5a1d-8808-65dcd2babba9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-33939 does not affect version 3.0.8-tuxcare.4 of handlebars. not_affected \u2014 Handlebars version 3.0.8 is not affected by CVE-2026-33939. Decorator functionality (the vulnerable feature) was introduced in version 4.0.0 and does not exist in this version. The vulnerability requires decorator syntax ({{*name}}) to be parsed and compiled, which is impossible in 3.0.8 as the lexer, parser, and compiler lack decorator support entirely.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-33940",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:785668fd-1e7d-58a0-bb45-34128a130759",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-33940 is fixed in version 3.0.8-tuxcare.4 of handlebars."
      }
    },
    {
      "id": "CVE-2026-33941",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3830fc29-2039-5ed2-8b2b-53b3c44149e0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-33941 is fixed in version 3.0.8-tuxcare.4 of handlebars."
      }
    },
    {
      "id": "GHSA-442j-39wm-28r2",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:16117b80-8234-56eb-84ba-1f691c2caed8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-442j-39wm-28r2 is fixed in version 3.0.8-tuxcare.4 of handlebars."
      }
    },
    {
      "id": "GHSA-6r5x-hmgg-7h53",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4a1b4b34-7d39-58db-83b7-f4bd9b360bfe",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-6r5x-hmgg-7h53 is a false positive for handlebars 3.0.8-tuxcare.4."
      }
    },
    {
      "id": "GHSA-7rx3-28cr-v5wh",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3a6199ff-e1da-56b6-91cd-0b67a06018a0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-7rx3-28cr-v5wh is fixed in version 3.0.8-tuxcare.4 of handlebars."
      }
    },
    {
      "id": "GHSA-fmr4-7g9q-7hc7",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b63b8b45-6719-58d5-96e6-c885543ba325",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-fmr4-7g9q-7hc7 is a false positive for handlebars 3.0.8-tuxcare.4."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/handlebars@3.0.8-tuxcare.4"
    }
  ]
}