{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3c364601-3a08-5466-9a7d-0d14b05a3701", "version": 1, "metadata": { "timestamp": "2026-10-31T19:06:33Z", "tools": { "components": [ { "type": "application", "name": "tools/make-vex.cjs (E-Rechnung Prüfer)", "version": "0.4.0" } ] }, "manufacturer": { "name": "Serhii Akhnazarov", "contact": [ { "name": "Serhii Akhnazarov", "email": "ahnazarovser@gmail.com" } ] }, "component": { "type": "application", "bom-ref": "e-rechnung-pruefer", "name": "E-Rechnung Prüfer", "version": "0.4.0", "purl": "pkg:github/serhiiakhnazarov/e-rechnung-pruefer@v0.4.0" }, "properties": [ { "name": "e-rechnung-pruefer:sbom", "value": "urn:cdx:fae38eb7-7a6f-5ca9-884a-60e78c42ed65/1" }, { "name": "e-rechnung-pruefer:scope", "value": "every known vulnerability of a component of the program or of a component it derives from (pedigree), with its assessment; vulnerabilities of the build and test environment: test-environment.cdx.json and the OSV report of the workflow security" } ] }, "vulnerabilities": [ { "bom-ref": "vex:CVE-2020-14338", "id": "CVE-2020-14338", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14338" }, "references": [ { "id": "GHSA-w4jq-qh47-hvjq", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-w4jq-qh47-hvjq" } }, { "id": "CVE-2020-14621", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14621" } } ], "cwes": [ 20 ], "description": "XMLSchemaValidator of Xerces (JAXP) did not enforce the feature use-grammar-pool-only: a crafted document could make the validator load and use a schema grammar named by the document (same flaw as CVE-2020-14621 in OpenJDK).", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "src/xsd-validator.js follows the assessment order of XMLSchemaValidator but contains no grammar loading at all: it validates only against the schema models compiled from the official XSDs and embedded in the page; xsi:schemaLocation and xsi:noNamespaceSchemaLocation are accepted and never followed (no resolver, no network access – Content-Security-Policy connect-src 'none'). A root element without declaration is reported as cvc-elt.1.a, as by the fixed Xerces with use-grammar-pool-only. The OpenJDK 21 sources it follows contain the fix of CVE-2020-14621. (Component lineage: Apache Xerces-J (XMLSchemaValidator), pedigree of file:src/xsd-validator.js in the SBOM.)", "firstIssued": "2026-10-21T00:00:00Z", "lastUpdated": "2026-10-21T00:00:00Z" }, "affects": [ { "ref": "urn:cdx:fae38eb7-7a6f-5ca9-884a-60e78c42ed65/1#file:src/xsd-validator.js" } ] }, { "bom-ref": "vex:CVE-2022-23437", "id": "CVE-2022-23437", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23437" }, "references": [ { "id": "GHSA-h65f-jvqw-m9fj", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-h65f-jvqw-m9fj" } } ], "cwes": [ 91 ], "description": "The Xerces-J XML parser enters an infinite loop on specially crafted XML document payloads.", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The flaw is in the XML scanner of Xerces. src/xsd-validator.js contains no XML parser: it validates a DOM that the browser's own parser (DOMParser) or, in the Node tests, slimdom produced; no code of the Xerces scanner was translated. Hostile XML is additionally bounded by the refusal of document type declarations and the nesting limit (src/pruefer-core.js, suite robustness). (Component lineage: Apache Xerces-J (XML parser), pedigree of file:src/xsd-validator.js in the SBOM.)", "firstIssued": "2026-10-21T00:00:00Z", "lastUpdated": "2026-10-21T00:00:00Z" }, "affects": [ { "ref": "urn:cdx:fae38eb7-7a6f-5ca9-884a-60e78c42ed65/1#file:src/xsd-validator.js" } ] }, { "bom-ref": "vex:CVE-2013-4002", "id": "CVE-2013-4002", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002" }, "references": [ { "id": "GHSA-7j4h-8wpf-rqfh", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-7j4h-8wpf-rqfh" } } ], "cwes": [ 112 ], "description": "XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0 allows a denial of service via vectors related to XML attribute names.", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The flaw is in XMLScanner (parsing of attribute names). src/xsd-validator.js contains no XML scanner or parser; it validates an already parsed DOM. (Component lineage: Apache Xerces-J (XMLScanner), pedigree of file:src/xsd-validator.js in the SBOM.)", "firstIssued": "2026-10-21T00:00:00Z", "lastUpdated": "2026-10-21T00:00:00Z" }, "affects": [ { "ref": "urn:cdx:fae38eb7-7a6f-5ca9-884a-60e78c42ed65/1#file:src/xsd-validator.js" } ] }, { "bom-ref": "vex:CVE-2012-0881", "id": "CVE-2012-0881", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0881" }, "references": [ { "id": "GHSA-vmqm-g3vh-847m", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-vmqm-g3vh-847m" } } ], "cwes": [ 400 ], "description": "Apache Xerces2 Java Parser before 2.12.0 allows a denial of service (CPU consumption) via a crafted message that triggers hash table collisions.", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The flaw is in the parser's symbol table (hash collisions of names). src/xsd-validator.js contains neither the parser nor its symbol table; names are compared as JavaScript strings in Map objects of the JavaScript engine. (Component lineage: Apache Xerces-J (SymbolTable), pedigree of file:src/xsd-validator.js in the SBOM.)", "firstIssued": "2026-10-21T00:00:00Z", "lastUpdated": "2026-10-21T00:00:00Z" }, "affects": [ { "ref": "urn:cdx:fae38eb7-7a6f-5ca9-884a-60e78c42ed65/1#file:src/xsd-validator.js" } ] }, { "bom-ref": "vex:CVE-2009-2625", "id": "CVE-2009-2625", "source": { "name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2625" }, "references": [ { "id": "GHSA-334p-wv2m-w3vp", "source": { "name": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-334p-wv2m-w3vp" } } ], "description": "XMLScanner.java in Apache Xerces2 Java allows a denial of service (infinite loop and application hang) via malformed XML input.", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The flaw is in XMLScanner. src/xsd-validator.js contains no XML scanner or parser; malformed XML is rejected by the browser's parser before validation (suite robustness, robustness-browser-*). (Component lineage: Apache Xerces-J (XMLScanner), pedigree of file:src/xsd-validator.js in the SBOM.)", "firstIssued": "2026-10-21T00:00:00Z", "lastUpdated": "2026-10-21T00:00:00Z" }, "affects": [ { "ref": "urn:cdx:fae38eb7-7a6f-5ca9-884a-60e78c42ed65/1#file:src/xsd-validator.js" } ] } ] }