{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:98aca58b-68f5-5009-beff-e75378970c3c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/dompurify@3.2.3-tuxcare.1", "type": "library", "name": "dompurify", "version": "3.2.3-tuxcare.1", "purl": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:025dcdb6-81a7-5bd0-8dc0-dfb09dc20686", "id": "CVE-2025-15599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3104decc-b3a3-5f09-9ca2-c00bc9e77d2a", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6acc4949-be53-5f9b-89b9-8824a48fdc2f", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:35bb6329-140a-5ca7-b296-6894dd3989a9", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1d2807cf-c60e-5514-a268-8739f50f2428", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4c475b3b-6dfe-53b5-aa79-bc86447bb935", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:661ab5a0-1938-51be-bca1-63d87f636a61", "id": "CVE-2026-49458", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c2c537ed-b905-55ae-9e92-a06536a54dd5", "id": "CVE-2026-49459", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6391c9d5-4023-5ba0-9cf5-28f4a3eb145e", "id": "CVE-2026-49978", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3d87a4ad-5ca5-551e-b1a9-6afdf55866ad", "id": "CVE-2026-65898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:efeeb5ef-fd14-53fa-b580-8e457b232859", "id": "CVE-2026-65899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:13c959f8-9753-5a32-921d-9aa7f37ac1e8", "id": "CVE-2026-65900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f6d08fb1-dcc6-5ef1-b4f6-9cf34d4ecff1", "id": "CVE-2026-65901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e3732f9a-cb5e-57bd-aead-0c1a57a222e1", "id": "CVE-2026-65902", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fd295456-78c0-5f26-9b5f-793383ba8ea7", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3-tuxcare.1 of dompurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short..." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:63a13bd0-9a91-5ca2-bd8f-82ec134f7c7c", "id": "CVE-2026-65912", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3-tuxcare.1 of dompurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f1b95cba-1538-54ea-a75d-4ff01c726ff4", "id": "CVE-2026-65913", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8ff13855-118a-5899-bcf4-53b707f206c6", "id": "CVE-2026-65914", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:062fffe4-9786-59ea-8f43-deaecea46f35", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b78f22b0-f180-5d51-a7b4-22bbca4a4542", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-76mc-f452-cxcm affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:be69b346-7062-587a-8067-82cd5a2dc863", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fcd220a9-1c01-5317-8fcb-7d70dcfb5d4f", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cb9c0f8e-579b-5900-bcf8-a1ef856d1540", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:eb1a66ca-e505-5e72-87a7-d54f23804aa2", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a47e0ff4-9e1c-58c2-a149-17930ac08201", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:eb97b41b-a96a-59be-a0e6-97ec782dd9ee", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:277a448a-d5fc-5bb8-a88c-68f3784b2e0f", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a9d4380a-8c11-5f66-aca8-5de5393351d4", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 affects version 3.2.3-tuxcare.1 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.1" } ] }