{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5f2a9fa5-67f5-5bf0-a2b4-6357d857c4d5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.12-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.12-tuxcare.1", "version": "3.4.12-tuxcare.1", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.12", "type": "library", "version": "3.4.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:110ce39b-3411-5211-ae50-fe09d406aa53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:34b62e41-ace7-5130-9ec7-b0604b6f5727", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:7fe9a080-d3d6-5581-a523-c59d0014062e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:126f430c-2c2e-59cb-9d67-b48520548278", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:d997a34f-9fe3-55fb-b9e1-aee5529197cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:014474d9-9176-5b6b-8bbf-7eff7106db07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:3c86879f-7e49-5f1e-963d-eb29a4405885", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:78ac1ccd-81e8-55fc-9cf7-6352eaa7230a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:e169bfe8-da4e-57f6-bb25-b7f3937dc976", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:d4331888-2f9a-51fa-809d-9a339d43ded9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-109345 affects version 3.4.12-tuxcare.1 of dompurify, and is fixed in 3.4.12-tuxcare.3." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:11e31c4a-0ae2-54e6-b2ba-030d432ebff9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:a33b881b-edd2-52ac-9080-9b3d7e641bb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.12-tuxcare.1 of dompurify, and is fixed in 3.4.12-tuxcare.3." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:310af862-f83f-5dd8-b1fa-37f59cae2169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.12-tuxcare.1 of dompurify, and is fixed in 3.4.12-tuxcare.3." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:3ed27e8f-a1de-565b-9dd6-c925dfa254f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:35d094fc-bb8c-5447-bb03-b55544e74d7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:f177eda7-69b4-50b8-9c25-042c783ff224", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:71d364e5-382b-513c-94f9-c1736f4aa849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:8c4f2209-70a4-541b-a835-45987816a2ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:b3de2d8a-3b24-5f46-89e2-ba524186dda3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:3ddb4659-8213-595d-9c7b-05f750a78858", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:5cc86cc8-3f3e-59be-b211-e888027871b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:662725b8-f65a-54ef-9c63-7dd73f2ad30b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:48ce6877-dcd2-5b11-b470-bbc754df1c7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:2b67d2fe-2cfb-5c87-8ce1-fad621eda246", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:a0ba6192-7df1-5b4f-bea4-f407ceca6d07", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.12-tuxcare.1 of dompurify. not_affected \u2014 The target DOMPurify 3.4.12-tuxcare.4 is not affected by CVE-2026-65902. The vulnerability was fixed in upstream release 3.4.11 (commit 0cae51874, June 2026) by cloning ALLOWED_TAGS and ALLOWED_ATTR before passing them to sanitization hooks, preventing permanent mutation of default allow-lists. This fix was already present in upstream 3.4.12 when TuxCare onboarded that version.", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:2fb95452-d0e0-56b9-86f2-3fe8df8f48c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:4b2afe49-f73f-5476-bdb2-e51cabd0c842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:ccd93e94-edd5-567f-bc8d-6a07f1112abb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:e302afe9-4084-562a-b401-08d94d4af5d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:cac4f7e7-ba5d-5718-b1f8-ee29e4792785", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:25fdc51b-b0e6-5a29-8eef-43fbfdfe116b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:4235605f-0427-5389-a018-f38b0199a7dd", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:9130ad11-6fec-51ed-81e5-d23a835af220", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:45c8684f-7d96-565e-beb3-47c8ec3ccfac", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.12-tuxcare.1 of dompurify, and is fixed in 3.4.12-tuxcare.2." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:a8a68f18-7363-5f12-8ea1-5eab2f2fd665", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.12-tuxcare.1 of dompurify, and is fixed in 3.4.12-tuxcare.4." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:8262a21a-7291-5797-b1d7-b339632cfc9a", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.12-tuxcare.1." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:607a4f57-b2b5-563c-b6a7-aab7d0c31da4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.12-tuxcare.1 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:976bedf6-d1ab-5cb8-b8c9-f6c5039c9cfe", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.12-tuxcare.1 of dompurify, and is fixed in 3.4.12-tuxcare.3." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ], "bom-ref": "urn:uuid:127d4960-148e-5a45-affe-8e32fa3273a0", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.12-tuxcare.1 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.1" } ] }