{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f2e8b962-2ede-5321-a405-c7bd7bea85f6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "highcharts",
      "purl": "pkg:npm/highcharts@6.2.0-tuxcare.3",
      "type": "library",
      "bom-ref": "pkg:npm/highcharts@6.2.0-tuxcare.3",
      "version": "6.2.0-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "highcharts",
            "purl": "pkg:npm/highcharts@6.2.0",
            "type": "library",
            "version": "6.2.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-29489",
      "affects": [
        {
          "ref": "pkg:npm/highcharts@6.2.0-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ec78d7cd-5aae-5798-adc3-ccd1c936807b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-29489 is fixed in version 6.2.0-tuxcare.3 of highcharts."
      }
    },
    {
      "id": "CVE-2026-116796",
      "affects": [
        {
          "ref": "pkg:npm/highcharts@6.2.0-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8f766c86-75c7-5645-a8cc-81c4dc6c3d0d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-116796 does not affect version 6.2.0-tuxcare.3 of highcharts. not_affected \u2014 Highcharts 6.2.0 is not affected by CVE-2026-116796. The vulnerability describes xlink:href attributes bypassing an allowed-scheme filter in the AST.filterUserAttributes function, which was introduced in versions 10.3.2+. Version 6.2.0 predates this architecture: it lacks the AST module entirely and does not process xlink:href attributes. While the buildText function (lines 5877-6221) processes...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-118244",
      "affects": [
        {
          "ref": "pkg:npm/highcharts@6.2.0-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8243cc8c-1898-50bc-bc90-4c1e3f45a7f9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118244 affects version 6.2.0-tuxcare.3 of highcharts."
      }
    },
    {
      "id": "CVE-2026-118246",
      "affects": [
        {
          "ref": "pkg:npm/highcharts@6.2.0-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:2f6b6f01-9073-581d-a6a1-e05bde568f41",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-118246 does not affect version 6.2.0-tuxcare.3 of highcharts. not_affected \u2014 Version 6.2.0 is NOT affected by CVE-2026-118246. The vulnerability describes an XSS attack through the breadcrumbs feature (breadcrumbs.style configuration applied as unfiltered SVG attributes), but the breadcrumbs feature does not exist in version 6.2.0. Breadcrumbs were introduced in Highcharts v10.0.0, while this target is v6.2.0 from the earlier v6.x series. Exhaustive searches for \"breadc...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-118249",
      "affects": [
        {
          "ref": "pkg:npm/highcharts@6.2.0-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1436df53-b071-52e3-ba93-8795328d3667",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118249 affects version 6.2.0-tuxcare.3 of highcharts."
      }
    },
    {
      "id": "CVE-2026-118250",
      "affects": [
        {
          "ref": "pkg:npm/highcharts@6.2.0-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e236142a-5d9e-552b-acc9-a704b052d9ba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118250 affects version 6.2.0-tuxcare.3 of highcharts."
      }
    },
    {
      "id": "CVE-2026-118251",
      "affects": [
        {
          "ref": "pkg:npm/highcharts@6.2.0-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:91509613-21d6-5237-9c3a-d494b67e9af2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-118251 affects version 6.2.0-tuxcare.3 of highcharts."
      }
    },
    {
      "id": "GHSA-gr4j-r575-g665",
      "affects": [
        {
          "ref": "pkg:npm/highcharts@6.2.0-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:2108932f-9cfd-57c7-9a7a-552f47d0412e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-gr4j-r575-g665 is fixed in version 6.2.0-tuxcare.3 of highcharts."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/highcharts@6.2.0-tuxcare.3"
    }
  ]
}