{
  "@id": "urn:uuid:f8769663-4292-4b86-9254-f5a0054e62e7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:47:00.151806+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/%40vitejs/plugin-legacy@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40vitejs/plugin-legacy@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-4w7w-66w2-5vf9 is fixed in version 5.4.14-tuxcare.2 of @vitejs/plugin-legacy.",
      "vulnerability": {
        "name": "GHSA-4w7w-66w2-5vf9"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40vitejs/plugin-legacy@5.4.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/%40vitejs/plugin-legacy@5.4.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T16:20:54.459511+00:00",
      "status_notes": "Vulnerability GHSA-v2wj-q39q-566r does not affect version 5.4.14-tuxcare.2 of @vitejs/plugin-legacy. not_affected \u2014 Target vite 5.4.14-tuxcare.4 is not vulnerable to GHSA-v2wj-q39q-566r. The vulnerable code pattern from upstream vite 8.x (using checkLoadingAccess on uncleaned URLs) is not present. Instead, the target uses deniedServingAccessForTransform with checkServingAccess, which internally calls fsPathFromUrl \u2192 cleanUrl to strip query parameters before checking server.fs.deny patterns. This provides equ...",
      "vulnerability": {
        "name": "GHSA-v2wj-q39q-566r"
      },
      "impact_statement": "not_affected \u2014 Target vite 5.4.14-tuxcare.4 is not vulnerable to GHSA-v2wj-q39q-566r. The vulnerable code pattern from upstream vite 8.x (using checkLoadingAccess on uncleaned URLs) is not present. Instead, the target uses deniedServingAccessForTransform with checkServingAccess, which internally calls fsPathFromUrl \u2192 cleanUrl to strip query parameters before checking server.fs.deny patterns. This provides equ..."
    }
  ]
}