{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2768c8bc-9a42-5b61-8774-0d6c0b66d270", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/dompurify@3.2.3-tuxcare.2", "type": "library", "name": "dompurify", "version": "3.2.3-tuxcare.2", "purl": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e66dc87a-a753-5a67-8232-67bf55919776", "id": "CVE-2025-15599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2626e9ce-d9db-5847-80f1-50a96aa563f0", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7701c7c1-e423-5fb1-a224-365c872e3efb", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2441644a-c0a9-5495-b89e-fd1afd456bff", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8c9827b1-88ee-5bc3-a438-cf33df656f19", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:852bf3ed-ae1f-5a26-824c-8a7a81924649", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bd5577ca-e472-5929-a6f1-38e1ab12e176", "id": "CVE-2026-49458", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:df6da327-d658-5741-9e3d-a6994303367a", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:19cfe711-323c-51bd-9593-dd90acea03b9", "id": "CVE-2026-49978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8359e92e-c670-5635-b729-80cdff255fc5", "id": "CVE-2026-65898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0dd4e219-9b6b-526d-b3cd-a6303d14f78f", "id": "CVE-2026-65899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:eb9f9a04-c50a-584d-a127-19a9a5543fbe", "id": "CVE-2026-65900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:827a037a-9bd6-51f4-bbd4-423f5bce52a6", "id": "CVE-2026-65901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:99b48d93-a222-5a09-bccc-041ef322e39e", "id": "CVE-2026-65902", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d93c3c6d-41d3-559c-b001-3115ac7d8cf2", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3-tuxcare.2 of dompurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short..." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:edd09986-85af-54bd-88a5-11175ebf6ef2", "id": "CVE-2026-65912", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3-tuxcare.2 of dompurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fd4c1d9f-03b0-5160-ace8-2df611b9ac59", "id": "CVE-2026-65913", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6fd16f04-9f28-565e-bfe3-976efc8374d5", "id": "CVE-2026-65914", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4562e0e9-5baa-5b68-ba2d-1dde5cb9f657", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6740f611-56c2-5b19-999f-b7656ef3e35d", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d617dd3f-a9a6-5ccd-8ffc-be001630e5bb", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ac50839b-e03e-5e10-bd6c-1250935961c5", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d771dc51-3dc2-58cd-88fb-cdc46ee89276", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5408c539-92b6-5f87-8a3b-5982545cb30e", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3ee4a32c-f7a9-5e4a-9ea8-1474898cae25", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:977218eb-d59c-5fb9-a45d-3b515d7cf78e", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7c2e61e4-615e-532c-b4fb-628580490da3", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:827eb848-cc0a-5813-a9dc-b53ad1b7573b", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.2.3-tuxcare.2 of dompurify." }, "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.2" } ] }