{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:05cc3d5a-a00b-5878-b71c-e5cf03e089e7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@2.3.3-tuxcare.1", "version": "2.3.3-tuxcare.1", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3", "type": "library", "version": "2.3.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:795ebca3-1409-512c-af6a-f83b35ac10aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:718306cc-aaf1-5d36-af76-8e8c2b337482", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:bd5d8c9f-b523-50b7-95ff-af5f88714d9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d2089b64-02af-527e-a9ba-e69c76784fb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:a405538c-9a91-531b-a774-b7cd66196642", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.2." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:a15b6c49-c277-598a-b370-a97849f5ddde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.2." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:49ae3a9d-3121-5bbf-8fc0-81adf0660ae7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:267ec902-dfd1-5823-8544-ba9b1306bfcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:4277c3aa-8537-58ee-88c2-00326a8e420b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9758102b-6ca4-5616-8eb3-66223d4e5717", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d9f3674a-d284-5716-8abf-b64c438d8736", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.5." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:c902eba7-0310-518e-8485-e96ca37a9812", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:b92ca4fc-36f4-5f92-85dd-6a159a91826d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e5589412-0766-5f28-821d-5673879b2c5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:497bde52-9117-5da6-a35d-79728410756d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:04787835-fcf2-574b-aa8d-3db88d175b8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:8ef0992c-8d58-59f8-8c89-71b084eeaf67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:a8319a8f-9779-5344-a46b-d581fedb2588", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:90c3655a-562f-5dd1-8e7b-543255986ac9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:a7b6e411-8bec-52aa-ae2c-69fb0ebd2d49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.2." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:adc0a20e-67ed-54f0-bceb-96062ae103ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:c2412a9e-7d04-5fbc-a620-5e901004f4be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:cd9bb33d-bb2a-55a2-a5ed-8105ae814651", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9ac5d79e-9008-50c9-bbb4-bdc998e48873", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:f48d02fa-c355-580d-ba6e-11f0ccb05747", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:c71ee4ea-e95d-5518-b155-5e166833fcfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.3." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d67f81e7-0003-56f5-b689-61f41706de95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.2." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:2ba8ae23-ee42-5a1d-8e97-45fd9768b66a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.2." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e348ad00-fd05-5075-8ee9-cbb2db679985", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-66010 does not affect version 2.3.3-tuxcare.1 of dompurify. not_affected \u2014 Version 2.3.3 is not affected by CVE-2026-66010. The vulnerability requires the CUSTOM_ELEMENT_HANDLING configuration feature, which was introduced in version 2.3.4. Version 2.3.3 predates this feature and therefore cannot process the attack input (HTML with custom elements when CUSTOM_ELEMENT_HANDLING is enabled). The vulnerable code path that allows custom elements to bypass afterSanitizeElem...", "justification": "code_not_present" } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:dce8f404-2061-5997-b6d4-bd04ce1ee876", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.6." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e3c8fb9e-d2b5-5ee3-916b-8a936a2560a8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:c00d9b33-3f5d-5d8f-be47-6a60d8943bce", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e4b238d3-dd46-5d82-a3b6-c5078b786fcd", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.4." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:ba9c55af-4fee-530d-b518-9abc11eb3fef", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:6d851dac-427b-5675-b86e-0092d1260295", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 2.3.3-tuxcare.1." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:43f1de2b-b108-5969-a502-90cb43429773", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 2.3.3-tuxcare.1 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:8f720cae-f161-5b3d-94be-276ea685f2c5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 2.3.3-tuxcare.1 of dompurify, and is fixed in 2.3.3-tuxcare.4." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e9d288a3-a7dd-5653-b967-c327b2b498de", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 2.3.3-tuxcare.1 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.1" } ] }