{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3c71c333-c6b2-5c76-baf3-636af2f474eb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.3-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.3-tuxcare.6", "version": "3.0.3-tuxcare.6", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.3", "type": "library", "version": "3.0.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:7d13bd39-9d8a-565e-9a51-5fe88b6c1b79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:1b9a0ade-196b-5f31-8a7a-f655f11af594", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:5c2c4a74-1173-53f7-939e-ef4090b97600", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:81bd1d44-216d-55d5-839a-f3dfdc22d411", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:72b71ff4-481f-56ab-8591-de103dbba0b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:5e8d31fa-31af-5a06-b30f-b13cc1346219", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:271bf473-5279-5e9d-a5f2-fcabe4e92501", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:cd757ba6-58b5-5b29-a935-719af78d3e4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:0d0f7b4b-0daf-5698-9bb7-3e4335f6f12c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:077caec5-b063-535d-a6b5-2d2dffae4856", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:1ce8f304-a0bd-5b37-bbc6-dc479893b243", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.0.3-tuxcare.6 of dompurify, and is fixed in 3.0.3-tuxcare.9." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:5cc7828c-4786-5b77-99e2-4a7099dff172", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:d2be892c-1b12-58af-8749-98d02b4a29a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:a7a5ef86-ee86-581c-b135-653951d61893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:ef9955d7-033f-5ef4-ab89-1a749898f1bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:64367fc7-ae0e-5394-9b8d-5814b4d10cdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:417d19e0-f92d-57da-9ef9-7319e57c2e70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:754da467-4b8d-599c-b17b-42717c28f807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:05b78a3d-3f4b-5da9-9cf9-75934765320d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:d7224825-9b04-573b-b850-cae22bd29072", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:27e8225c-721c-5037-a922-202564fe1efe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:d9294f82-b88e-5f68-818e-912745007a7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:af920fa8-2c7c-5514-b217-69d43c7c1de5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:ffe05bfe-af3f-51dd-83bf-35dcae04755b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:dab7c8e5-366c-55f2-a259-58c52aaf2c69", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.6 of dompurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:d32f2c8a-4dc0-5900-a15e-920a395195c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:7130a7e9-51bb-5334-9d18-1559821f8638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:b13ac4ee-a198-55c6-9bc1-9e3c0ef0ae82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:02fe56a8-1c9a-58a1-b6be-509382be3f7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:2baadf03-ccd6-519e-9cbb-eef78e36c0c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:34dd7f22-64d6-5777-9dbe-dff809a07110", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:99398853-3c5c-5029-a387-77329fa6e28c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:06f5297a-268a-5e49-892f-5016a2a2ca96", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:be6ae2c9-0aa4-5a24-b76b-b2fde6a7b9f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:d087b852-ed4d-51a8-a024-9b32a60b5083", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:ff7f322a-1571-5f7c-8340-2bbb9e6d257f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.3-tuxcare.6 of dompurify, and is fixed in 3.0.3-tuxcare.8." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:b489b7b9-f28e-55b8-b2f7-32c281a299ac", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:de79b1f9-eb54-532a-bb07-ee4b5d56ed1d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:8177b691-bc9b-505d-950a-1b11e3ef2aa9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:1649fee9-fdbb-5864-b360-4140c5f3f9c5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:f23cdc8d-b1ca-564b-983c-88b046b0821e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:469ff644-6279-53e1-b759-81087569b011", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:67c1b9dc-0f96-591b-9683-08e40836531a", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.3-tuxcare.6." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:6b61c41e-8c6a-502d-a19b-fe8d298b3b98", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:981f9897-753c-5aed-8294-7ebeeb1cf578", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.3-tuxcare.6 of dompurify, and is fixed in 3.0.3-tuxcare.9." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:c461d5f5-07b6-5d60-9ab5-ac29a937596a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:3427f7e9-fcce-5d30-b27e-b80a5132235c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.0.3-tuxcare.6 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ], "bom-ref": "urn:uuid:85eb835c-cdd6-51e4-b8cd-2d3945a197ae", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.0.3-tuxcare.6 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.6" } ] }