{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:43699c2a-6dcd-523e-a467-5e489f2b439f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.12-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.12-tuxcare.3", "version": "3.4.12-tuxcare.3", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.12", "type": "library", "version": "3.4.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:c82e83fc-aa65-5d4e-bb22-1b18b1a24a94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:9b9c7b26-371c-59e8-a09d-acb4f09265fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:073a596e-de7f-5e96-b863-baed9e9645c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:48ad3e96-a954-5c59-b64d-97b3f2cefa45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:7020c9c5-e36b-5e93-9e4b-475d3b9ddad4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:20be6693-0624-5983-9b81-9082b3f72fe5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:53a706aa-b2d9-55c0-b3d1-ff4f0c1dbb91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:7be8ea75-a025-53e1-9b05-419529ecc00d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:d18149f5-b616-50e1-ab89-ba4ed381c43b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:1174dcf4-12ca-5012-8a1e-f7ceb57cbb37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109345 is fixed in version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:25516e6e-c171-59dc-8f2f-3eea070679fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:64fad724-ebc5-57dc-a212-6277fe49b182", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:3392d8ac-ead3-523c-b62e-77fff0ed5a69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116804 is fixed in version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:d022632e-f6e8-5cf6-9d12-8453734af539", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:2fd9b2f8-5fff-5320-b5cf-b20c487d4819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:5f32e66e-5ca0-589d-b6d0-78ab0137356b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:a47d98a5-8e09-5442-8f00-299c1748b91b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:15f593a3-b635-5603-9a8d-71ab741318b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:b2ab3491-e985-5d14-b8b0-c184f2e002ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:adb75b30-aa71-53e8-b88b-ceec43483193", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:28b35832-a8c5-50a0-8591-081f58b242fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:6aa95767-6157-5331-a5d3-ee9e3f7fd071", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:bf169b61-2ea9-5b19-bbb9-8ef86fcaf156", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:3ac78b95-be62-5fa2-89e8-cd69c001d9fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:c0494ee0-034d-5b94-9065-c75e56a4eece", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.12-tuxcare.3 of dompurify. not_affected \u2014 The target DOMPurify 3.4.12-tuxcare.4 is not affected by CVE-2026-65902. The vulnerability was fixed in upstream release 3.4.11 (commit 0cae51874, June 2026) by cloning ALLOWED_TAGS and ALLOWED_ATTR before passing them to sanitization hooks, preventing permanent mutation of default allow-lists. This fix was already present in upstream 3.4.12 when TuxCare onboarded that version.", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:10902aa9-8e95-5f58-a064-027ce978ea73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:1ed93f33-7a6b-5c12-8dfa-0d58cd71a97a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:08a77124-7cef-544f-bab8-4d745acff655", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:d2bb1b7b-8715-5961-863a-fe1dbb34418e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:6867a93d-10b6-5ac0-8aac-5f209364e542", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:b6a4aede-dfe6-5823-91db-45773e483297", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:60d1724e-3a1a-5280-b680-3c04db08ff34", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:81bf5269-8bc5-5d9e-b8ed-94bc84cef951", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:d6710334-e27e-54c3-80b0-0c3beee47aac", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:25e0e177-226c-5321-8086-5ab87b4c2f6c", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.12-tuxcare.3 of dompurify, and is fixed in 3.4.12-tuxcare.4." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:9080a0c2-db50-5d9c-8d35-9fc21b534141", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.12-tuxcare.3." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:e3f56afa-afa6-573c-be6a-7086e4332ad6", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:9a985125-9a97-5185-b70b-3973fca2b971", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.4.12-tuxcare.3 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ], "bom-ref": "urn:uuid:22b7c46c-f1bb-5fef-86f5-b23180b69672", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.12-tuxcare.3 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.12-tuxcare.3" } ] }