{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0133710d-86b2-5e94-823a-cac962aeb0f5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/dompurify@2.3.3-tuxcare.6", "version": "2.3.3-tuxcare.6", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3", "type": "library", "version": "2.3.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:276c93ea-99e6-5836-9d23-3643e7caba56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:11d68f11-31c5-5c5f-afe0-ac8c619e9029", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:6626ae99-8ef5-5db6-a5db-71fc17978130", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:881cac9b-a878-5b69-a962-fd2dcdb9ab3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:e11c6ca9-6c1e-593d-aaeb-a8202791ac07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:d0f78f16-7c34-5ecc-8b90-e5e54826bad9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-48910 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:2be21e46-5052-5b67-8b3e-e7add1860efa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:316e0079-31a0-5bcf-ae21-4409e332d7c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:833fcdab-a89b-5729-a2be-43c90df6d0d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:c454e509-4fb0-52ed-9ac3-7b2229685d83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:2d6319dc-760a-5550-87c9-9bb7b24a6a7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:87125507-842e-55eb-b607-62a7f4e57355", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:7af8726f-0041-5cef-ae0c-82df042c2a0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:aa88b5dd-ff62-5eb7-b283-510f67780b6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:974f8401-7c90-5f3f-a231-251947b6ed01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:0e7096ee-d83c-55ce-b05e-cd550e323506", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:a263ab2b-c5e2-504e-8251-82f90d113eb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:ecf98524-b194-5d5c-9888-b0173f23018e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:da219a02-bc47-51db-8b2a-e73a56cb30d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:e3f6875a-a1f2-57be-8a50-244cbeb3c6fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:4a737ffa-775a-50dd-8892-394c60984b43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:2903a10d-f11d-5230-b276-1342ff03ab05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:32b1cfcc-0716-5f13-879e-5f804a3052da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:4513e86f-9954-5d68-ba91-ac370624d370", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:a0a090fb-c702-5546-b6df-0ef745ae9482", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65903 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:5c20c806-b517-564b-bdc5-a7d70849a832", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:bb6c8a23-7e45-52ad-bd48-a27694a3df43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:ffd27a2d-ec50-5284-a50b-bf73893521f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:37f275fc-f131-57de-85ea-a7a136c7f067", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-66010 does not affect version 2.3.3-tuxcare.6 of dompurify. not_affected \u2014 Version 2.3.3 is not affected by CVE-2026-66010. The vulnerability requires the CUSTOM_ELEMENT_HANDLING configuration feature, which was introduced in version 2.3.4. Version 2.3.3 predates this feature and therefore cannot process the attack input (HTML with custom elements when CUSTOM_ELEMENT_HANDLING is enabled). The vulnerable code path that allows custom elements to bypass afterSanitizeElem...", "justification": "code_not_present" } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:81d26667-1ea9-5e16-b17e-babe70fbf436", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:e6ada0d0-b012-5853-a36a-95706a5692e9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:68b23ea1-b15e-5385-9668-f2aa02abe0ec", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:ed9fa9d0-f054-59ef-aea2-fdfe4eb021cc", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:4878024f-d234-56fb-bee1-0f5db5e65edc", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:14d81fc7-1e5c-574b-88bc-80f0fd1b0222", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 2.3.3-tuxcare.6." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:933ba840-2ebe-5b15-84c3-a4f1457b8d4e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:82f6c437-1aea-5405-bc49-cd8d09e0d26e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 2.3.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ], "bom-ref": "urn:uuid:ae897e33-f801-524a-bd0a-21956313e87c", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 2.3.3-tuxcare.6 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.6" } ] }