{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:749c62e6-108e-544b-b195-01fdb3a03548", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/dompurify@3.0.3-tuxcare.4", "type": "library", "name": "dompurify", "version": "3.0.3-tuxcare.4", "purl": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:2963ae63-c197-52ae-a968-12cab960279c", "id": "CVE-2015-8861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-8861 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:50e71884-f627-590c-9373-eee437f948c3", "id": "CVE-2019-19919", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-19919 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6170bb68-f557-50f5-b025-6037dd269645", "id": "CVE-2019-20920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-20920 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:72e7f6ff-31d1-59fb-9857-12f28c2f6a9f", "id": "CVE-2021-23369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23369 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b155f80e-8ea0-546f-ae38-939d9f454370", "id": "CVE-2021-23383", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23383 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7cab9399-283d-5ba3-8fe6-41c8b48a8780", "id": "CVE-2024-45801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1a7be6fc-a1dd-529a-b9ac-02e3647c5108", "id": "CVE-2024-47875", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:74941ef5-eccb-5978-93f1-be0b895d2b53", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8a04cc74-8f68-5103-a67b-d6d5559b562d", "id": "CVE-2025-32996", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32996 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a635ce73-593f-55fc-82bc-588d08e6d34a", "id": "CVE-2025-32997", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32997 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ad0c3962-f496-5904-a453-ecd087cdb565", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:13cd0f91-9712-5e85-b334-5f7383f7a81b", "id": "CVE-2026-13676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-13676 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5eee440f-00b8-5243-8214-5fc6c7eea6c0", "id": "CVE-2026-16221", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-16221 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a7631fe1-10a5-59f0-8896-a8924c853910", "id": "CVE-2026-33940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33940 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b5f253e1-805d-5983-894c-9ec3816394e7", "id": "CVE-2026-33941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33941 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e7bb7701-44a2-5f47-8720-16db09f8655c", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fcf40835-3290-574b-a697-5217547f600c", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8937b6d3-4ec4-5ade-a356-4cef4cfb4dfc", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:eb0454ae-88aa-58d6-b7e0-78aa7791bd9d", "id": "CVE-2026-49458", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2ae4c732-15ad-59c4-b9b0-e9b4493a4316", "id": "CVE-2026-49459", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e34c31f3-8064-5bbb-bad0-22c20e3890d2", "id": "CVE-2026-49978", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d796bdec-54d6-5346-b4e6-c7c34a6ca69b", "id": "CVE-2026-55602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55602 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a4167934-ae10-5b51-bcc0-bbf0128a6360", "id": "CVE-2026-6321", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6321 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:df062093-3ccf-5203-9eed-418c38674df2", "id": "CVE-2026-6322", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6322 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:774a31b0-0793-597d-a0fa-92409305c9e9", "id": "CVE-2026-65898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ad4da677-8f5f-5b4c-ba02-fcc3204d6913", "id": "CVE-2026-65899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2ed3b405-a7e0-5b14-afbe-add29976711c", "id": "CVE-2026-65900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:07c41ce5-7f20-5aa3-8e03-9cee313d9b13", "id": "CVE-2026-65901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e2df1300-f73d-5c62-a42c-e2915e711a37", "id": "CVE-2026-65902", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6fb5fd30-fb0a-5a9a-8961-c7f75e4269fd", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.4 of dompurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:72f7e4db-646e-572b-afd2-a216a5cd2ba3", "id": "CVE-2026-65912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4edda108-f813-5467-ad9d-e6fc44db952e", "id": "CVE-2026-65913", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:58de2900-60bc-5fcb-9b8a-44bbd7f949e8", "id": "CVE-2026-65914", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e9219bf7-4b97-57d6-b442-540e0c5a368b", "id": "GHSA-2cf5-4w76-r9qv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2cf5-4w76-r9qv is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:acb9eeba-f2bc-5be6-8c92-c7c2c3c541e0", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:340e4741-8c3e-50ce-af63-3021b370d3d4", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5c513af2-1379-5239-8b23-abc09bf3626a", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:32ec26e2-cd43-5663-869d-c654883c00d9", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9d13025b-10ba-5327-9a30-7bff8f2cb0ad", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9b503f97-b9a1-5125-97dd-41eb25ee918a", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:935e5826-f52d-538d-9699-c59158a8a90b", "id": "GHSA-g9r4-xpmj-mj65", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-g9r4-xpmj-mj65 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:75dfca5b-c914-5ab3-bfb1-bbad6acbf55a", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:10217e9c-0918-5700-927e-66e1a2074eee", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:53a5513b-5ce3-5278-8c1f-3c736d612493", "id": "GHSA-q2c6-c6pm-g3gh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q2c6-c6pm-g3gh is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6bb0fb00-8425-514c-ae11-4822f89a27e7", "id": "GHSA-q42p-pg8m-cqh6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q42p-pg8m-cqh6 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2ace0568-9d29-5e55-9796-473c0ef56cd2", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4c70ae9a-d27d-55d4-b21e-ebde047d539f", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.0.3-tuxcare.4 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.4" } ] }