{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:888026f0-f57e-5e8f-8c1d-8085b67484f2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.10-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.10-tuxcare.4", "version": "3.4.10-tuxcare.4", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.10", "type": "library", "version": "3.4.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:78768d99-cd13-5915-908f-f3b9baaaf6bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:06eb6efe-c74c-5aef-a16b-018f0bf7eb06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:fe64a33a-32b1-570b-ba27-f6ff46c37a86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:d8919270-62db-5999-bb07-3daee6877755", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:5e18c8ca-9469-5657-9ea6-e08509437326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:36b96383-bf31-570f-9c77-e2fd0da204cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:1ac2ebb2-cb22-5e68-a41b-8db841b6e2eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:a60b2e26-9289-5305-ad91-44c23a9cbb49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:d0d73000-73fd-57e5-b3c7-1c019228fe02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:23062acf-4bc5-5b64-a302-a1f262e21a7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109345 is fixed in version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:7de6b625-564c-524c-97b7-de7a2f5d5c98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:d8751aa4-2bb7-5b1b-b659-d417cec65a6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.10-tuxcare.4 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:a34cfdff-7329-5dfc-84aa-ae327ecabcc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.10-tuxcare.4 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:b7e2c9f4-b1f1-5035-abfe-f6fd81ab70dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:cd75b16f-3b59-5254-a0fb-1624442d875c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:a71aaca3-3d72-5b49-8290-c3de3856fcb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:5abbed7e-6875-5ebd-a6a9-eb86fc112e50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:11df3bb3-8d0c-5bed-99dc-ce650c8c9f93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:c6c45e61-f7be-5408-8ffd-0bfcf6650939", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:7ddbc7e0-6083-520d-9eb0-aeb9add8a858", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:bfa50879-e12f-54e1-8774-8e1f65512963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:c99c8ef7-32d6-51d9-888f-83f46fffdde2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:77322fda-e5ee-5bbd-a8fd-c880a7e7e41d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:100b3391-1886-5eda-ab95-4fcaf59ba713", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:f0b8bad1-faff-584b-a646-426671815f91", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.10-tuxcare.4 of dompurify. not_affected \u2014 CVE-2026-65902 is not present in DOMPurify 3.4.10-tuxcare.6. The vulnerability (hook-driven permanent pollution of module-level default allow-lists) was fixed in upstream release 3.4.7 (commit ca30f070), which is an ancestor of the current target. The fix clones ALLOWED_TAGS and ALLOWED_ATTR before passing them to hooks, preventing permanent mutations. This upstream fix was already present when...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:e4da7e76-3a1c-5b00-9b4d-b1bc5466995f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:c48c48ef-13d6-56c0-b0ce-f7102c223ab0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:a63008d6-69dd-5eb2-bee8-6d26e8d69bea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:92e2fd4c-5ba7-518c-a1e3-b3da69d2702a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:b5a5dd6c-56c0-5d67-8952-9c79ba5c7108", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:e4f98b25-5794-5a10-8a39-6cf5f8ead543", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:dd1351e4-4d67-5554-a229-798f9c294565", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:1f7ab2dd-88ba-58ce-99af-4a0a31024303", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:c559dea9-07c2-5da7-8c9d-dee960b2873e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:c25b0457-f095-5472-bf71-bb38b456fb5f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.10-tuxcare.4 of dompurify, and is fixed in 3.4.10-tuxcare.6." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:1f454285-d38e-583a-b641-676888339858", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.10-tuxcare.4." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:9d8650b9-a8be-5aa3-85c5-7b3cd027adbb", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.10-tuxcare.4 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:ed97752f-fd32-5d26-860f-c7341ef2b1d0", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.10-tuxcare.4 of dompurify, and is fixed in 3.4.10-tuxcare.5." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ], "bom-ref": "urn:uuid:004f2fbc-7820-5552-a01d-23a1a6aa4586", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.10-tuxcare.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.4" } ] }