{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8a2abc9a-2db1-5cd4-9f5b-3d879300b5bd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.10-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.10-tuxcare.2", "version": "3.4.10-tuxcare.2", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.10", "type": "library", "version": "3.4.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:687649f6-cdfe-5b90-9dc6-ff3aee295730", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:dc905f1a-08ae-5f82-bc46-70923058cf27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:9ecf45e4-fa88-53d9-9b4e-ce45bca8f953", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:2b44ab97-a49d-5f41-8179-cd36d13e4d1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:dce35df2-507c-50d4-b063-31243630886a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:9fb09adb-da33-59fa-b1ae-316f0e39a905", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:8ad112d1-93bb-56ac-bffa-9296b76d5918", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:2aca1007-69a3-5f3b-b795-0409e3702d03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:812309ee-4852-50e4-a49b-addc7e74cfb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:33d30f34-7f66-531d-ab28-680f1e0adf33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109345 is fixed in version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:2d14dfdb-facb-5ce6-8afc-4516c9f4fee2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:0a0f654f-2e31-5c98-9d66-10dc7727fd99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.10-tuxcare.2 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:04d8cce4-a950-5c74-8ddc-393e0971f9dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.10-tuxcare.2 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:47e226d4-1eec-5cb5-8868-0e3f8f185ef4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:2cdbb2b2-ca28-5395-a840-9a5606b0ae89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:28dd495f-0e32-563e-9025-fbf6acad8d2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:cc697a6f-4f4d-567b-af19-994f35fd41eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:3e9b66b5-c26e-586f-b676-d6c6cc147330", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:91179bd8-e19b-59eb-9ee4-c3b527032742", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:13ea5aa9-5b9a-58d4-b1c2-93e8dae36c63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:912bceb5-4409-5e07-a61e-a5a2a3c51aa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:27fd41f2-eb4a-5ce6-88fc-f0a3c20b0719", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:02ad512c-90ce-51b4-b978-8747d7e14079", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:7314453f-9c7f-5990-9a14-5b4ee341b99a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:a68c29ae-141b-5248-a232-ddfd4634d38a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.10-tuxcare.2 of dompurify. not_affected \u2014 CVE-2026-65902 is not present in DOMPurify 3.4.10-tuxcare.6. The vulnerability (hook-driven permanent pollution of module-level default allow-lists) was fixed in upstream release 3.4.7 (commit ca30f070), which is an ancestor of the current target. The fix clones ALLOWED_TAGS and ALLOWED_ATTR before passing them to hooks, preventing permanent mutations. This upstream fix was already present when...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:54a4965e-b985-59fb-880e-121bc79c31cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:fc421545-3e4f-517d-a977-a592c1e0c8db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:a1061ef2-fd69-5551-8639-dc5fa7f76b8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:0cf33122-8969-5bbf-9db7-c8c4dae12ec1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:4c5d9326-3db7-5dbe-af52-8b7f8d32d605", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:9efc939c-490f-5bad-b5ca-a2e55678c6ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:66175695-608c-560a-a09e-767bd4d4eb03", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:7cddfa44-b68a-5787-9834-98f090bb5b36", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:40d8de78-336a-58ad-a75e-b4f2f7a4f226", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.10-tuxcare.2 of dompurify, and is fixed in 3.4.10-tuxcare.4." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:98736c0a-d967-5338-9ed3-ee575f0c4c54", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.10-tuxcare.2 of dompurify, and is fixed in 3.4.10-tuxcare.6." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:036e179b-cfee-5c9b-ae7b-6c80b6b1fa71", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.10-tuxcare.2." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:55479b2a-6d0a-5a7b-b7ca-86a4ce520649", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.10-tuxcare.2 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:49e12313-2a5e-50e0-a013-1a83b9bcc31b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.10-tuxcare.2 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ], "bom-ref": "urn:uuid:31b61068-451b-58fd-ba65-a44e7f738fc4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.10-tuxcare.2 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.2" } ] }