{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:31b28086-4dca-5b7d-822f-28b475c85b8c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.10-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.10-tuxcare.1", "version": "3.4.10-tuxcare.1", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.10", "type": "library", "version": "3.4.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:1fc79cd1-6c66-5174-b494-ade347434cfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:d5d1b5ba-5f09-5640-ac66-757e678dcef7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:dd1d5a73-500e-57c7-8304-dd794d6d2bcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:167a9a77-9d68-5a17-a307-d94c2e6dc8e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:734048e3-c976-5d5b-96ac-b59168f57b3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:239eee10-9095-5465-ab4a-488934443cfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:433106a6-995b-5bd3-8a05-e7cb2f5f7576", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:33ce2863-4fe9-5a95-b853-1c6829f0b090", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:f28b5c9b-b0fc-5a03-98e1-533bd12199b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:7cc48c74-dfb2-5e08-8b69-6227d3a95a9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-109345 affects version 3.4.10-tuxcare.1 of dompurify, and is fixed in 3.4.10-tuxcare.2." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:6b62cf01-c0b9-5733-a73d-e312b748f2fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:32a4e883-c66e-5d72-8b2b-7efe3cb3d6ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.10-tuxcare.1 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:48e36e94-1f5c-51b1-950e-898b6602aa16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.10-tuxcare.1 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:931b5827-d1a1-53e8-85ee-dee9f5e42e64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:f9ebb253-14eb-5167-bdaa-ecb474541dbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:4698cc45-7926-5fa7-a50c-592767612224", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:28827db8-b339-5711-8488-884ec2dc3e20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:a50e5a94-42b2-5a11-a17f-48bdf52902c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:570280a5-1732-50bb-b450-f6196d726ebc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:ef50c22e-f63b-50ab-985a-7eb48d44e127", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:7315d848-6d0c-5672-b547-e8231a5ddccf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.10-tuxcare.1 of dompurify, and is fixed in 3.4.10-tuxcare.2." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:ab6ec38b-60f0-5c48-bdf2-9f5f8de6f30b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:3c30844a-51b0-5657-94ea-f5bf4b29f603", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:2ff857e3-dbf6-5bb2-8518-7e697a950e4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:013d73ae-ae98-5d94-9b9e-4e021434b8ce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.10-tuxcare.1 of dompurify. not_affected \u2014 CVE-2026-65902 is not present in DOMPurify 3.4.10-tuxcare.6. The vulnerability (hook-driven permanent pollution of module-level default allow-lists) was fixed in upstream release 3.4.7 (commit ca30f070), which is an ancestor of the current target. The fix clones ALLOWED_TAGS and ALLOWED_ATTR before passing them to hooks, preventing permanent mutations. This upstream fix was already present when...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:bc2f28bf-7f27-530a-b2bf-9c674a0bd90d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:fa617ab3-81c5-53bc-8dc5-98c3e2992f21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:22fefaf1-734e-5037-b65e-bce12bcc8eb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:37a9a34c-8c08-5618-bafa-75f6e404fcd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:def50d6e-46e6-528c-a058-7a0a7a4076d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:c32b320b-7efe-5c45-95fb-1e2f3abeba64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.4.10-tuxcare.1 of dompurify, and is fixed in 3.4.10-tuxcare.2." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:cf52e8e5-4d81-5cdd-ba29-c2826d38cb5f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:a6b8c769-2472-5ea4-b55b-08be285e0d94", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:a4723538-4f69-5baf-82a8-36e23bdfee0b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.10-tuxcare.1 of dompurify, and is fixed in 3.4.10-tuxcare.4." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:238eaecd-59e0-5801-9b83-db7fb3ddbea3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.10-tuxcare.1 of dompurify, and is fixed in 3.4.10-tuxcare.6." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:a2e2026b-dbda-521d-942c-00602c9746dc", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.10-tuxcare.1." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:89ab8d8d-7ac9-528d-bb7d-939cbdf5d8a4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.10-tuxcare.1 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:56786446-2559-5fb9-a9f0-0379588c93da", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.10-tuxcare.1 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:67e70c7e-9b0a-59ce-a56e-8136bf311060", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.10-tuxcare.1 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.1" } ] }