{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ec19da60-2e98-588b-9fbc-990cbcd125f8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.10-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.10-tuxcare.6", "version": "3.4.10-tuxcare.6", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.10", "type": "library", "version": "3.4.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:749d2cfc-b2de-582f-96f4-371f0c38582f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:50fb1a08-e363-558a-ac92-a032d5ab82d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:1f552f21-c9cb-5a8a-8432-0df654a5620a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:16c39ad8-f105-5a04-93d9-77c27b49233c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:b2730689-f0e9-594e-bc76-75618e617773", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:06aba997-3db9-585a-85dd-d9adf83bb784", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:d68cc2d3-5b83-52af-beda-8b8ad0280a62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:aff9f309-1ff2-5142-9a37-9107903c2a4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:723fff1d-9e27-5614-aa20-4a8703f7213d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:efd321e9-e294-5c18-b42d-786fc43fa048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109345 is fixed in version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:c86ea296-f86d-5b80-8ab9-bcfdba2ee4ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:8762b150-59a1-5ba9-a353-e695ce297353", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:332c5f3a-3c90-5cdf-9f01-04288154dee2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116804 is fixed in version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:32da4a92-7c16-5e96-87cd-f7f63c7bdb2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:4dee2712-c190-59d7-92e0-a0212add77c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:43281239-6182-5231-a6bf-d0202cc144ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:62474270-ae22-5039-8b36-e81fade3b762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:2e4a6ff3-2e0a-5c9a-969e-d6536f2eea44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:33b7e40d-3aec-5456-b0e9-5c5fd2e2cb14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:5d8b90c6-9908-5692-b327-a88c3780f949", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:b0c85839-870e-5aee-a17d-624745e9b685", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:64402e77-5743-55b8-87f3-0dc46859fb28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:6964db8c-9753-5f89-bd7a-0acac6d797e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:a04750a5-9d95-5477-ac9a-bcb11e5abce7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:38d88d3a-2a76-572f-9328-84b40d208c41", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.10-tuxcare.6 of dompurify. not_affected \u2014 CVE-2026-65902 is not present in DOMPurify 3.4.10-tuxcare.6. The vulnerability (hook-driven permanent pollution of module-level default allow-lists) was fixed in upstream release 3.4.7 (commit ca30f070), which is an ancestor of the current target. The fix clones ALLOWED_TAGS and ALLOWED_ATTR before passing them to hooks, preventing permanent mutations. This upstream fix was already present when...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:87712307-e1d9-52e7-b76d-a7478c2a96c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:15d99262-7462-51fa-9890-b8268f4c8b29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:7e545213-9ee2-5843-8792-3fad85b8dc4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:a4228747-17e0-504c-ad2c-95397c20c6e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:9d3991c4-a4b7-54fe-9427-d43d5aa8e393", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:5ea7fbd8-1fac-5126-a69b-71d0e48f8923", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:9140bfd8-9ff2-5fb5-b4ba-5b519142dfc3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:95ad110d-b4fd-52d2-9689-b40d56022a2c", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:98176aa3-6f40-5d82-a1fc-87d6971fdc1a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:b8e0569a-5877-5c0d-a869-033db8415c87", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 is fixed in version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:50498996-43f7-5389-b39e-7ac7b9696ce7", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.10-tuxcare.6." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:b990f5ba-d023-5a58-a43f-169ca9e0d399", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:db545f5d-3199-599c-8cea-571dae316d8a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.4.10-tuxcare.6 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ], "bom-ref": "urn:uuid:990e51f6-f855-506b-9c34-6e1cc06dc0cd", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.10-tuxcare.6 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.10-tuxcare.6" } ] }