{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ce125c6a-dbe8-506c-8a5b-16195fbac6a1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.4-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.4-tuxcare.1", "version": "3.0.4-tuxcare.1", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.4", "type": "library", "version": "3.0.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:7d69c3b3-71fe-5aac-a7db-46b86f051fc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:aeb40ea2-785e-50f0-883d-0881e0c5d586", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:3ae0062c-7524-59d7-bebd-3e91af721a40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:e161ed5a-9932-5888-82e0-afe99096bda2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.4." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:02c7d45b-6cf8-5f83-bfed-f877174ab5b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.4." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:58037ac9-c6eb-55d8-88d9-6a0f472932e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:68433861-c30b-59a6-9095-88719ff92185", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:c3078b57-6e03-54e2-a437-f906d0fb031c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.4." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:73ee9c81-2442-57f2-8910-53a4450b451f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:b796ae79-90a8-52c8-a1c0-661d1537b36d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:42c61f2a-07b4-5a71-b6e2-61e256b3a900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.4." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:35832966-7349-569d-9724-66b8d1e2c4bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:51043e7b-ed27-5fc0-b60b-286b02c048cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:78e5e228-0b4e-5e00-92f2-c8fb8b4797e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.5." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:72530906-8483-5657-bc27-33d17e7297de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.4-tuxcare.1 of dompurify. not_affected \u2014 DOMPurify 3.0.4-tuxcare.1 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (introduced in v3.3.1+ via commit 6c08b7d1) to bypass FORBID_TAGS checks. Version 3.0.4 predates this feature by ~8 minor versions and only supports array-based ADD_TAGS. The vulnerable code path (EXTRA_ELEMENT_HANDLING.tagCheck evaluation) does not exist in this version...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:345c13ec-8516-5eb6-9aa1-e59b84e23486", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:5fbe3261-b7a4-5f8f-a13b-d546b939c15e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.4." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:f35567fb-5f4d-5e54-bc70-2a9422b77bd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.4." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:af46f17e-8d43-591d-97db-2159dfce3efc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.5." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:c0715359-9975-5251-9931-9b2e9cca14d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:eadbd6cb-2537-5cae-8de6-224ff8be8b19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.4." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:f219699e-4129-5a50-af8a-39eff391d46a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:c1ee8c30-f981-5727-864d-d34a09df3b85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.4." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:3c01d4fd-0971-53ce-92e0-839a9cfdbe20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.5." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:c6157c7f-f6fb-5799-b8d3-8b02cf718605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.4-tuxcare.1 of dompurify. not_affected \u2014 Target version 3.0.4 does not have the short-circuit vulnerability described in CVE-2026-65903. The target uses a different architecture where FORBID_TAGS is explicitly checked via a guard condition (line 1019: `!FORBID_TAGS[tagName]`) before allowing custom handlers to keep elements. The upstream's vulnerable short-circuit pattern does not exist in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:676196aa-b7ca-5ad2-8302-3a8653f85021", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.4-tuxcare.1 of dompurify. not_affected \u2014 DOMPurify 3.0.4 is not affected by CVE-2026-65912. The vulnerability requires the ADD_ATTR predicate function feature (EXTRA_ELEMENT_HANDLING.attributeCheck), which was introduced in version 3.3.0 (commit fa239f04, October 2025)\u2014approximately 2 years after version 3.0.4 was released (June 2023). Version 3.0.4 only supports ADD_ATTR as an array of attribute names, not as a predicate function, so...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:59ecef42-cb49-5935-832c-38553d50376d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.4." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:89d608b1-01cb-5ca1-abb7-fb0caaed107c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:7e783759-ed58-50c3-8633-f2610f014e3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.2." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:58a2bf80-fc67-50f7-8178-e47955f9d65e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.4." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:099e09ad-58fa-572d-919d-3bcde42342a4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:24a3949f-24fe-5204-b431-5d3657d6203c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:94025306-aa3f-5940-bb28-ed49e77633bf", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.3." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:e54b41b8-a133-5d13-8c87-36d03aea8e8e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:ae5629b2-a54b-586c-b6b8-f69d5f65d27c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.4-tuxcare.1." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:279538c9-f2a4-516a-86bb-dba8e3ca145c", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.0.4-tuxcare.1 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:2d112d93-c458-51d1-8be8-000c22c2802a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.0.4-tuxcare.1 of dompurify, and is fixed in 3.0.4-tuxcare.4." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ], "bom-ref": "urn:uuid:5ebf1df3-7ec1-5296-ae7b-11e01c57aa21", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.0.4-tuxcare.1 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.1" } ] }