{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2661acc0-5480-54b6-842b-1ff9e0498d96", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.12-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.12-tuxcare.2", "version": "3.4.12-tuxcare.2", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.12", "type": "library", "version": "3.4.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:bfa3f9a6-0c8a-5c71-96ca-6bd4fd8c03e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:fc027341-4e4b-5681-80d0-c26321053719", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:b6e09107-2239-5216-bc1f-9af5b6f46eeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:9d03d5c3-2fe5-59b1-a2b9-f8505b8b6e21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:ff55279f-2945-5c4b-a012-30947b35be98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:7279e0a4-49f3-5114-9a6a-7e59ced97ff4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:1d733411-5b9d-52d6-ad6b-5113baaf8fed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:9c774582-a506-5a35-af11-9d9605acf414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:2d9ee248-c8bd-5ac3-9c05-6a7c37246200", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:8f755562-234b-516a-a404-c0ef66f6ae21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-109345 affects version 3.4.12-tuxcare.2 of dompurify, and is fixed in 3.4.12-tuxcare.3." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:9f694d77-8633-5ce9-9b50-83dc59fa0e78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:4bad3045-6292-56b1-ba04-24378830fb13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.12-tuxcare.2 of dompurify, and is fixed in 3.4.12-tuxcare.3." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:6d696d10-1541-5321-9d40-68be9e6c2f23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.12-tuxcare.2 of dompurify, and is fixed in 3.4.12-tuxcare.3." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:02c80080-7fad-54ec-815a-0ef88fbc8842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:2bc11f32-5192-5f61-a342-93cc6ae92a5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:323e5d20-0c42-56b4-88e2-500a4c35b642", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:9d6a0c8e-9542-56c7-a7e3-63cef6bf106d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:d12000c1-29bf-5de0-b31f-39f6d5cac487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:006a2594-d197-5b43-874d-04c39fd04a87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:1e0f15e4-5df6-5a2b-a47b-66d7c69045a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:580ffb93-e0a6-5fc1-a413-5d0db923cab5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:cb6ccace-044e-5955-a52c-e82c597057cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:a2026560-303e-5e89-ba78-ffd4a36320c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:753786ca-3761-5319-b35b-e39cd130f99a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:60c83f50-fe14-56a1-9985-4556a0dca705", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.12-tuxcare.2 of dompurify. not_affected \u2014 The target DOMPurify 3.4.12-tuxcare.4 is not affected by CVE-2026-65902. The vulnerability was fixed in upstream release 3.4.11 (commit 0cae51874, June 2026) by cloning ALLOWED_TAGS and ALLOWED_ATTR before passing them to sanitization hooks, preventing permanent mutation of default allow-lists. This fix was already present in upstream 3.4.12 when TuxCare onboarded that version.", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:10f073d8-7e3b-5876-94ef-eae43691aee7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:89e68972-e944-5796-b66f-1d9f4fedc6b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:4ad4be4a-c825-533d-ac32-af675f2fdc89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:a639fd1a-3fc1-5471-ae50-33eb78717160", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:160610a0-84de-54ce-ab49-3c7930a3c174", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:d1341e7b-d451-5dc9-a99c-7504105a73ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:5a4e5830-edcd-5f80-9b83-e85c1d448d9b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:62da30d7-f399-5e9c-beab-e2bf2bd4b851", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:6a30ab9e-5393-5dfc-8712-1d8ba384e5e3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:b70d91b2-86bd-5150-86c0-a81152f2dd92", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.12-tuxcare.2 of dompurify, and is fixed in 3.4.12-tuxcare.4." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:3750e048-3298-5dbe-9f46-7f0e7c755c5d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.12-tuxcare.2." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:793953a4-2bdd-5b88-b727-86716288aeab", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.12-tuxcare.2 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:697775ca-820a-5e78-bc3a-91bf7379abcb", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.12-tuxcare.2 of dompurify, and is fixed in 3.4.12-tuxcare.3." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ], "bom-ref": "urn:uuid:e96fb5a8-3823-59ac-b64a-5347fc899602", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.12-tuxcare.2 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.2" } ] }