{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:80a7e334-a8cc-5bdd-80b7-eabdef253689", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.7-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/dompurify@3.2.7-tuxcare.5", "version": "3.2.7-tuxcare.5", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.7", "type": "library", "version": "3.2.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:672d2e2c-8f0e-52c7-a74e-048b4e2e9a86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:ff2d28d0-c553-50ac-9d9e-fd527fb52977", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:1c3f6092-2461-5bb6-9daa-78c9041acdb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:89d8d9a6-d812-590e-8c65-06822c92d990", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:6917d023-6d52-542b-9493-211471164db2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:acc08fe6-fc2f-5a51-b0d4-c4cb5bbe7d72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:1e780df2-4fa1-58b3-88c4-ebf12ada9199", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:fad802bc-5717-5c6a-9214-4a92000ecb44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:3b204300-0b51-5140-89b4-f98c9276a09d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:1bfa3a76-d448-52b4-bfe3-5d6f9c63d838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.2.7-tuxcare.5 of dompurify, and is fixed in 3.2.7-tuxcare.6." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:f30001cd-1d2e-52af-90a0-bef67d6fc75a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.2.7-tuxcare.5 of dompurify, and is fixed in 3.2.7-tuxcare.7." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:af864107-38a6-5db3-a021-29e8e33bb686", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:a60f3a65-47eb-5790-b5bb-05b245d0f402", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:5685455d-a58a-56f6-b28f-eb3c9bb9d30a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:a3ce8415-3bb8-58ea-83f2-732c0c52c6bf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.2.7-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify version 3.2.7 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires the EXTRA_ELEMENT_HANDLING.tagCheck feature and function-based ADD_TAGS configuration, which were introduced in version 3.3.0. Version 3.2.7 only supports array-based ADD_TAGS and lacks the EXTRA_ELEMENT_HANDLING mechanism entirely, making the attack vector described in the CVE impossible to trigger.", "justification": "code_not_present" } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:a2d11522-4c1c-5b19-be7a-b7e176c7dced", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:954f62ff-dcde-5cf9-a0a3-4058135e8f36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:e049223d-c054-5e74-9986-7453e7e53d06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:89b0f18e-bddd-5d7c-ba08-7fcc0869145c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:f319ce54-60e2-5be9-959f-34dd0bd1ca65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:d8ea3266-6d29-5867-a271-edc28ecb491c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:b4b70c2c-dc70-5ec5-8c80-c024741b1204", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:3429d2cd-6b1e-5478-b88b-15819d6d5ffd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:dd1de347-13e9-5e73-b227-faaba3630bed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:804b35cf-cbb0-5e05-a441-f4852878c2bf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.7-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify 3.2.7 is NOT affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck, a feature that allows ADD_TAGS to be used as a function, which was introduced in later versions (v3.3.3+). Version 3.2.7 only supports ADD_TAGS as a string array and does not have the EXTRA_ELEMENT_HANDLING mechanism. The existing CUSTOM_ELEMENT_HANDLING in 3.2.7 correctly prioritizes ...", "justification": "code_not_present" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:7c107259-7d27-5333-a4ec-737a81f49f79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.7-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify version 3.2.7 is not affected by CVE-2026-65912. The vulnerability requires ADD_ATTR to be provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck, which bypasses URI validation when returning true. This function-based ADD_ATTR feature was introduced in version 3.3.0 (PR #1150) AFTER the 3.2.7 release. The target version only supports ADD_ATTR as a string array (typ...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:134d5b66-d044-552f-8246-3ea26bc9bf8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:f5cf6cb8-0371-5e14-a2e6-0616406abd88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:59f050b4-e97c-5e77-bead-5d90f1698047", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:a87e15f8-a207-597d-9099-692db5401ad7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:bcbcb03f-3dfa-5cab-b57a-42ce5086a62a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:f43b455a-1a89-5910-8add-787ceb6d6018", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:049ab8c0-3383-5fa1-9d74-7292e4721c8d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:f43cab07-d25c-503b-a024-d73e18af430b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.2.7-tuxcare.5 of dompurify, and is fixed in 3.2.7-tuxcare.6." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:ee76e809-c978-55ae-94b3-7b42dc378056", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:dc078980-2203-5633-be6f-8501bc4504e3", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.2.7-tuxcare.5." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:0e8d56d9-a97d-58f4-94dd-6161f8c1db69", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.2.7-tuxcare.5 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:2eea15ed-e441-587d-9394-a8b8d76602b4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.2.7-tuxcare.5 of dompurify, and is fixed in 3.2.7-tuxcare.7." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ], "bom-ref": "urn:uuid:591cd7d0-7444-5b2e-a49c-8e28a1b3f624", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.2.7-tuxcare.5 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.5" } ] }