{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c4044889-b416-56f8-bfce-0525f3d32b52", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.6-tuxcare.7", "version": "3.0.6-tuxcare.7", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6", "type": "library", "version": "3.0.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:d7fee198-0f73-5241-8d53-628d75cbfdd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:77602e09-2141-55c3-813a-d967db80e6e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:431f56eb-1bfe-5b4d-a368-214bebdab09a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:41fa6de4-953b-5097-a561-d09ce54f2753", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.6-tuxcare.7 of dompurify, and is fixed in 3.0.6-tuxcare.8." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:ba77dd06-4764-5dd1-a649-bd4e6b2e543c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:c68b0b74-323d-588f-a4b9-0fece0f8c038", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:625ef8c2-5bcf-5304-877f-667034daf18d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:01744bfb-71c0-575c-8c0a-8f4ba34e39b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:d18c4d05-9b02-5b85-b29c-313fdccb278b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:6b67e5d2-1841-5f4f-b984-b1f27cda4df2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:c714e588-bf4a-57dc-94e9-c965d7c15aa8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:6e7d6eed-7f1b-54d4-a11c-52b92d91a2ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:8ee6c726-ac00-5612-aa60-46ea44fd5777", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:ea422d7c-d8b2-564a-86d9-135910737c58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.6-tuxcare.7 of dompurify, and is fixed in 3.0.6-tuxcare.8." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:c0605586-a586-5d75-9441-319fdf1bb408", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.6-tuxcare.7 of dompurify. not_affected \u2014 DOMPurify 3.0.6 is not affected by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS/ADD_ATTR configuration support, which was introduced in version 3.3.0 (October 2025). Version 3.0.6 (September 2023) predates this feature by 2 years and only supports array-based ADD_TAGS/ADD_ATTR through the addToSet() utility. The vulnerable code pattern (EXTRA_ELEMENT_HANDLING.tagCheck shor...", "justification": "code_not_present" } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:1c6f0ca2-4135-52a4-ad87-9857939222f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:daee552f-2fb8-5f02-93c2-09b0866a9c06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:769563af-1b87-5d08-8092-1695d59baa38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:f8a86c76-f25a-536f-9ee5-9af9d8c8fa4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:c16411e3-5eaa-5ce6-b030-7de8c3167966", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:9f1a36cc-ec9b-5f73-b03f-d0a06825b35f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:cff61991-ebb3-5a8f-a31c-6412ae5da8c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:8e20df1a-3634-5dc1-b013-07b68dc42854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:e1828474-cb08-52c8-9297-17eb08841557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.6-tuxcare.7 of dompurify, and is fixed in 3.0.6-tuxcare.8." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:569017f6-edc6-597c-9d88-db83592b09ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.6-tuxcare.7 of dompurify. not_affected \u2014 Target version 3.0.6 is not affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck functionality (allowing ADD_TAGS as a function), which was introduced in version 3.3.1 (October 2025). Version 3.0.6 predates this feature and uses a simpler, safe tag validation pattern that always checks FORBID_TAGS before any custom element exceptions.", "justification": "code_not_present" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:5911248a-819c-5e00-9b49-b0e35926d53f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.6-tuxcare.7 of dompurify. not_affected \u2014 DOMPurify v3.0.6-tuxcare.1 is NOT AFFECTED by CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (allowing predicate functions via EXTRA_ELEMENT_HANDLING.attributeCheck) that bypasses URI validation. This feature was introduced in PR #1150 (commit fa239f04) AFTER v3.0.6 was released. Version 3.0.6 only supports array-based ADD_ATTR, which always flows through URI val...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:abe9e48f-7811-5639-82de-e22f6062133c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:2a1141ee-1a37-5944-abaa-191a83b0bd1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:30746531-76ef-5674-8ea2-ea66a2ab0880", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:5069f52e-0406-53d6-ba09-ba84a99da736", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:68a66b3d-3296-5f47-a46f-c83755d50f69", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:3ea5424d-117e-5fab-9963-ca7d1b9e05ed", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:0baa2e00-715d-5df0-936a-a52778a5b4bb", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:5e3dee41-72b5-54be-b275-0683c8f9a92b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:f230ddc9-9a4a-5fb4-aa83-9619ca8c7609", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.6-tuxcare.7." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:e857f73a-4365-563a-8b1e-55cb3de94616", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:804d32ca-1f95-5b96-95fc-958950ab9def", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.0.6-tuxcare.7 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ], "bom-ref": "urn:uuid:f356c9d9-8145-5adf-bcd6-dd5b42c96b9e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.0.6-tuxcare.7 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.7" } ] }