{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8d762d9b-dc6f-5b89-9c4c-3926a8818f95", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.7-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/dompurify@3.2.7-tuxcare.7", "version": "3.2.7-tuxcare.7", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.7", "type": "library", "version": "3.2.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:09a542b3-76d3-50d0-918b-c5bb03a6816c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:b2931957-c1bc-5e7e-8a6b-54ee71416b6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:ef087036-5c1f-5283-b2cd-085622e4860e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:572fb861-0a90-5bc0-89b3-d99da37477c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:ae58a0ba-99ec-5dc5-9cd4-d19764778d9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:217203a2-1e73-5997-ba0a-280ee470f327", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:d3d0ac27-6311-5d03-991b-45903a8a4a23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:cda83c83-b49b-5a42-b2a8-2565e573547a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:d7c962c9-4c76-5981-b281-22bc22b3cbc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:69944b50-3601-5e22-8396-712dac0f3f81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116802 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:8a58fd04-eb09-5827-a822-26ae0e7fa0ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:e35a6fcf-aa26-54f1-b000-609bfcbaaeb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:8688a352-3892-53ab-bb45-dba3de78ca8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:7edbc46b-175a-55ff-b7b2-e1b8732ef022", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:99495289-9a70-57d3-a35e-457e368b5587", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.2.7-tuxcare.7 of dompurify. not_affected \u2014 DOMPurify version 3.2.7 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires the EXTRA_ELEMENT_HANDLING.tagCheck feature and function-based ADD_TAGS configuration, which were introduced in version 3.3.0. Version 3.2.7 only supports array-based ADD_TAGS and lacks the EXTRA_ELEMENT_HANDLING mechanism entirely, making the attack vector described in the CVE impossible to trigger.", "justification": "code_not_present" } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:d333e3f2-950b-5133-aeac-0f410ca4a813", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:ad605e61-5139-5ee9-8dcb-9e56101600cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:cea900bf-275a-5667-88c8-57e082835088", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:fad625ec-385e-5e6d-98f1-2dd0f1d9eea0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:40474d1d-e08d-5331-a9b7-77831247ebd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:6ffada32-7ec7-5f9e-8634-296a9b905fc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:c04a4f67-ce71-5217-9674-2fa8f5b5669c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:72f0f6c6-2a65-5027-be1b-7134f20e153f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:1b631b5e-c7d0-576b-8ced-3b4cfceca4c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:f4d48120-0b83-597c-9252-e6a239260bb1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.7-tuxcare.7 of dompurify. not_affected \u2014 DOMPurify 3.2.7 is NOT affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck, a feature that allows ADD_TAGS to be used as a function, which was introduced in later versions (v3.3.3+). Version 3.2.7 only supports ADD_TAGS as a string array and does not have the EXTRA_ELEMENT_HANDLING mechanism. The existing CUSTOM_ELEMENT_HANDLING in 3.2.7 correctly prioritizes ...", "justification": "code_not_present" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:33456646-1393-5030-96e1-86556db11197", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.7-tuxcare.7 of dompurify. not_affected \u2014 DOMPurify version 3.2.7 is not affected by CVE-2026-65912. The vulnerability requires ADD_ATTR to be provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck, which bypasses URI validation when returning true. This function-based ADD_ATTR feature was introduced in version 3.3.0 (PR #1150) AFTER the 3.2.7 release. The target version only supports ADD_ATTR as a string array (typ...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:859b3bc4-6827-5375-a7d2-c901873d7f9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:1cc9bf1b-76dc-565c-af55-bc5e895935a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:ee2f0628-4020-5ae5-b763-01d5ddc08830", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:6a524c54-d536-5a78-bb20-cdcc58c5f574", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:246c06cd-3ec8-5a63-bb5f-37b453e86553", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:179ea1ac-9319-51a1-90b4-390db96841f3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:f4110043-431b-5b7e-b7c5-a8b9cb2bbfcd", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:50ca828e-4f5f-55b0-81d2-e79b739bc675", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:f9bea796-5bb2-53fb-9896-8f7c722972d6", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:4507ad49-4cbf-5062-b4ba-7ae33f66eeef", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.2.7-tuxcare.7." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:ee22afeb-0e16-5526-8580-db6a7be76d84", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:d4e95404-b495-5409-90bd-ebb3a8fd4164", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.2.7-tuxcare.7 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ], "bom-ref": "urn:uuid:dffa3dec-3289-54b3-b3df-7b11e3b0e035", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.2.7-tuxcare.7 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.7-tuxcare.7" } ] }