{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:be1856b3-34e2-559d-b170-2db950e0e962", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.11-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.11-tuxcare.2", "version": "3.4.11-tuxcare.2", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.11", "type": "library", "version": "3.4.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:bbfe79ee-0df4-5098-bfbb-1e56aeeca966", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:86f070ff-ab9b-5bbc-8e1c-316fba1c2584", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:28724359-7126-53e0-a18d-1666da3339e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:ea4a4e5f-5035-55fa-aa5b-c0d0c0375b06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:e0ccaa95-a315-5bff-a89a-c4c7ef5c8257", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:ff5145e2-e0ce-5704-a471-9f3f6814fe14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:88ae8c93-35ed-5a11-8e1d-debfc8e6c1bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:4b07c8a9-bc1b-5c08-9f82-6978c3fead73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:b4780137-40ad-5413-bcdc-df1630bc90ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:e3f0111e-9f8b-5a4a-9f33-108b2fd1b1b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109345 is fixed in version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:4b993501-3759-5e6d-a49c-36aa0511b254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:d0db1d73-6493-5a17-bf10-c3eb18306690", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.11-tuxcare.2 of dompurify, and is fixed in 3.4.11-tuxcare.5." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:ae21a63f-08bc-5cfe-bed2-3c2cc28b08e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.11-tuxcare.2 of dompurify, and is fixed in 3.4.11-tuxcare.5." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:de7f6638-e76e-5876-a2c6-cf0e5f835224", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:2282c031-2b62-509f-8640-d08aac229273", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:f2c2f14f-3927-5ca8-b765-cca91ab21ac9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:2b870fe6-0513-5b05-a68a-a0f3a7cc9ad1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:642c822a-64ed-52e0-a4bd-a5f982c1b5cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:7248425c-9c64-5f45-93d5-621ed199b689", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:a51126a7-3412-51eb-b18e-cad215f59882", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:f0480c83-ee6d-5c3a-84e7-55fca210fc8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:635716e0-cdc6-5bef-93c8-4a0861dd2d5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:5379efce-be44-57e8-8dd0-4bbffeb13bc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:e03d195e-c0af-598d-b798-8fa4fb725104", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:458061d2-2951-5628-80c2-b8873c3dba17", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.11-tuxcare.2 of dompurify. not_affected \u2014 The target repository (DOMPurify 3.4.11-tuxcare.6) is NOT AFFECTED by CVE-2026-65902. The vulnerability was fixed in upstream DOMPurify 3.4.7 (commit ca30f070) by Cure53, and this fix was already present in the upstream 3.4.11 release that TuxCare onboarded. The fix adds defensive cloning of ALLOWED_TAGS and ALLOWED_ATTR before hooks execute, preventing hook mutations from permanently widening ...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:f78f980a-aa2a-5a94-81d0-9a113b0777ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:ca85b052-50b1-58d8-8eac-659d44d23b6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:d709338f-bc38-5577-9c42-7c1f180d9bf5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:b2b7729d-1a72-533e-a644-bfa422079c47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:b48c0973-b078-50d3-bd2b-b78303944ce5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:7b19517a-e2ed-5bde-9420-49291f635a26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:b634e034-12bc-5c13-9037-821ecb19a479", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:82789daa-d001-5adf-a9b4-fd896f646a94", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:c47e12a6-a227-519e-a7a9-e1abfe75030a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.11-tuxcare.2 of dompurify, and is fixed in 3.4.11-tuxcare.4." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:aa49a21d-6237-5c07-aab3-b8c62d176680", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.11-tuxcare.2 of dompurify, and is fixed in 3.4.11-tuxcare.6." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:693ee5c2-4da7-5fbd-82d8-69a4de22ce87", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.11-tuxcare.2." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:0b2227f2-4712-5ca8-80e3-379d89b9dd5b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.11-tuxcare.2 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:a952b10f-2465-55b8-9d82-edfb0cb992b8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.11-tuxcare.2 of dompurify, and is fixed in 3.4.11-tuxcare.5." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ], "bom-ref": "urn:uuid:aa746bbf-ef15-5fa3-922b-f097b66a6afc", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.11-tuxcare.2 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.11-tuxcare.2" } ] }