{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b360634-4504-5ea6-a0b5-753f2fe4b187", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.10-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.10-tuxcare.3", "version": "3.4.10-tuxcare.3", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.10", "type": "library", "version": "3.4.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:67f3571c-1303-56c6-8a74-114aa296f8bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:982553e4-33e1-599a-9af1-8e3b2c2ba9f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:81e4d609-668b-523a-95b1-d59eabb448fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:12df92f2-0295-51d6-a36a-bfd62a11aaf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:62ba58f0-1cbc-5a5f-9d28-f6e9448f243a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:a5e3d875-8336-532c-85c1-07d94278da4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:3b51c8f5-c8e7-5d56-b4d8-a41b0ceb276d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:a378a647-df9c-5dbc-8519-d0d1bbf04445", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:eb5e26ef-cfef-529b-9797-383867e68060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:5c6ee45f-bdcb-5ef9-a415-fd8daef8a263", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109345 is fixed in version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:e8c8c927-cef2-50d9-a0ad-0f76508b2dc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:2bc8f774-7304-5098-af49-4cd04f27267c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.10-tuxcare.3 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:9c5bdcb0-64ef-526f-b10c-5b5de636b6b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.10-tuxcare.3 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:d97eaa72-77e9-536f-9873-aaaaa7ba9eb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:18acaa60-3f9e-5802-a33f-a94114635079", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:2027174e-71d4-5336-9928-b6824e42fc90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:34630753-b012-5e23-a91a-0fb7bf974256", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:0312b313-49e3-56fd-8839-e8741d88fbfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:c3475286-981b-5743-989a-f3c0371374d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:1ab1439e-e6bd-5b30-be5b-62b32b8e3f1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:22e2eefa-2db4-5c97-9791-d4583cc700dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:15f7828c-587b-5736-80be-54c08f7f1495", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:dd8ef7ae-5576-5e5a-8c37-a7d61fadb05d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:7deb7686-6cba-5f56-9f37-6e67601f731f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:a8ba0b67-8439-580b-8007-2a5d306b3eb6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.10-tuxcare.3 of dompurify. not_affected \u2014 CVE-2026-65902 is not present in DOMPurify 3.4.10-tuxcare.6. The vulnerability (hook-driven permanent pollution of module-level default allow-lists) was fixed in upstream release 3.4.7 (commit ca30f070), which is an ancestor of the current target. The fix clones ALLOWED_TAGS and ALLOWED_ATTR before passing them to hooks, preventing permanent mutations. This upstream fix was already present when...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:ee3f61c1-57d8-5628-ad5c-03db415b5368", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:04e2bfb5-d9cd-5b83-9c62-4a138251864d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:d81b8a9c-500d-511e-8474-0e54618e39e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:1b720316-bb5f-582f-a751-0e95cfa80894", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:ba56f658-bb14-5fe4-915a-965a15fd71c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:1403988c-e3c4-59d3-85ee-02cec4497e88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:73ce70ae-bbe1-5129-9f7a-c5b3b074b3aa", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:d106f86c-bb4e-5e57-91e2-02bdc85faf96", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:c9bee08c-6a64-57a0-8a90-cef69f9a352f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.10-tuxcare.3 of dompurify, and is fixed in 3.4.10-tuxcare.4." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:11a5d762-6063-52c8-a71e-9b588fdc1afe", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.10-tuxcare.3 of dompurify, and is fixed in 3.4.10-tuxcare.6." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:9e64bde7-fcae-54bb-817c-cd7351447a7a", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.10-tuxcare.3." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:18edd7aa-7cf9-5cb2-81a0-51f019137237", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.10-tuxcare.3 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:c7d46ec0-a364-59d6-b442-e52f79f91ea8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.10-tuxcare.3 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ], "bom-ref": "urn:uuid:33b8f436-4450-57a5-87c7-e26f2ef21b91", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.10-tuxcare.3 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.3" } ] }