{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:240cb09b-1994-5dfc-a52c-f33a6529a64a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "handlebars",
      "purl": "pkg:npm/handlebars@4.7.9-tuxcare.3",
      "type": "library",
      "bom-ref": "pkg:npm/handlebars@4.7.9-tuxcare.3",
      "version": "4.7.9-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "handlebars",
            "purl": "pkg:npm/handlebars@4.7.9",
            "type": "library",
            "version": "4.7.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2015-8861",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b6008717-b8dd-5008-84fa-10f76e5a710b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2015-8861 is fixed in version 4.7.9-tuxcare.3 of handlebars."
      }
    },
    {
      "id": "CVE-2019-19919",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:859f5b48-fab6-58ed-93b9-8101c7027943",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2019-19919 is fixed in version 4.7.9-tuxcare.3 of handlebars."
      }
    },
    {
      "id": "CVE-2019-20920",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:69b8d3e8-fb20-5364-98f8-bf6536767578",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2019-20920 is fixed in version 4.7.9-tuxcare.3 of handlebars."
      }
    },
    {
      "id": "CVE-2021-23369",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d60c48f1-5a46-5785-b171-757d6ca4ea7f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-23369 is fixed in version 4.7.9-tuxcare.3 of handlebars."
      }
    },
    {
      "id": "CVE-2021-23383",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:26377c55-e2c9-5d2d-974a-122b817e55f9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-23383 is fixed in version 4.7.9-tuxcare.3 of handlebars."
      }
    },
    {
      "id": "CVE-2026-106444",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:2460f5eb-c57a-5fbb-8e7c-8d2b038acbbf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-106444 is fixed in version 4.7.9-tuxcare.3 of handlebars."
      }
    },
    {
      "id": "CVE-2026-106445",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:daa32e1e-59c7-5e29-bbc5-53633d6f9215",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-106445 does not affect version 4.7.9-tuxcare.3 of handlebars. not_affected \u2014 CVE-2026-106445 describes a hasOwnProperty bypass in Handlebars' lookupProperty function that allows accessing Function.prototype.constructor despite deny lists. The vulnerable code pattern exists at lib/handlebars/runtime.js:127-129, but exploitation is blocked by default configuration. The attack requires allowProtoMethodsByDefault:true to reach Function.prototype via __proto__, but this opti...",
        "justification": "requires_configuration"
      }
    },
    {
      "id": "CVE-2026-106446",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c92d8762-6ecf-58de-bb01-74f9398c59af",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-106446 is fixed in version 4.7.9-tuxcare.3 of handlebars."
      }
    },
    {
      "id": "GHSA-2cf5-4w76-r9qv",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:eca544f5-a019-5a61-91b3-ec487e00596a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-2cf5-4w76-r9qv is fixed in version 4.7.9-tuxcare.3 of handlebars."
      }
    },
    {
      "id": "GHSA-g9r4-xpmj-mj65",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ea81efb6-4eb7-5936-b4a1-b4334419cf5b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-g9r4-xpmj-mj65 is fixed in version 4.7.9-tuxcare.3 of handlebars."
      }
    },
    {
      "id": "GHSA-q2c6-c6pm-g3gh",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8777abde-012d-5f3b-96f1-4390d3aefe81",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-q2c6-c6pm-g3gh is fixed in version 4.7.9-tuxcare.3 of handlebars."
      }
    },
    {
      "id": "GHSA-q42p-pg8m-cqh6",
      "affects": [
        {
          "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:72437137-1b25-5020-8fd4-714d4abffeb6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-q42p-pg8m-cqh6 is fixed in version 4.7.9-tuxcare.3 of handlebars."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/handlebars@4.7.9-tuxcare.3"
    }
  ]
}