{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a5c82335-0332-5cd7-a091-646ea60a7571", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.13-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.13-tuxcare.1", "version": "3.4.13-tuxcare.1", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.13", "type": "library", "version": "3.4.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:507b2aa9-a44c-52b0-8df6-f039bbfd8703", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:42f7089a-f3d3-5782-a2b2-2bdd5efde66c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:3ec2d457-09b5-5d7c-87fd-202361fa6365", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:e142c4a3-58ad-5ef0-97d9-f3d245b2cc05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:da941ad1-7879-5061-b919-7df0f9473eff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:c7f02ca9-16fb-5ed4-93dd-965bb4eda3b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:cd82e641-132f-5eb6-a464-cbfd4d893a57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:f766e24d-833d-5ea5-8a33-07062bfd86b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:4176ffce-372c-54f4-b315-638ca811138f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-109344", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:42975039-4d40-515a-8137-eda29c8cef51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109344 is fixed in version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:e4faddbd-5c95-5bd8-ac92-70766d0346a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109345 is fixed in version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:87203cbd-13ff-5c07-b49a-8e405a2bbd8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:3fc95cec-e5c3-5350-bee8-07472134be4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.13-tuxcare.1 of dompurify, and is fixed in 3.4.13-tuxcare.3." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:4350b9dc-c69c-579e-afc0-0672101eebc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.13-tuxcare.1 of dompurify, and is fixed in 3.4.13-tuxcare.3." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:4fff421f-d759-52b8-8aae-9dfeeeca9c25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:826066dc-7470-560c-a15a-093d9f062154", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:a7864c72-7d48-5c32-939f-d96c41c5a483", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:afa3f8ac-6966-50ab-a2a0-8f8fba0993a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:1cebb06b-b084-5b66-9e01-f956138b75f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:3b2e1497-228d-5f5f-9904-f0021ce4cdb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:c47b909c-22d8-5805-a056-d3449741af02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:d895a319-79f8-56f7-8d51-dbd3eb7efe5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:0e80dc60-149f-50d9-8c5b-9d422ae559c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:10b70488-7cd2-5dda-aa68-7691f6097a22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:8a716a6f-38cd-5e90-9c7a-94b081aa6166", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:04158bd5-37d4-5db0-bd49-6f00ba355bae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.13-tuxcare.1 of dompurify. not_affected \u2014 The target dompurify version 3.4.13-tuxcare.4 is NOT vulnerable to CVE-2026-65902. The vulnerability (hook-driven allowlist pollution) was fixed upstream in DOMPurify 3.4.7, and the target's base version 3.4.13 already includes this fix. The _forkSharedAllowlist defense mechanism is present at src/purify.ts lines 2167-2178, which clones ALLOWED_TAGS and ALLOWED_ATTR before exposing them to hook...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:b62b09d4-1374-5691-abb3-95d0d21212e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:b6f76124-a1e7-564c-92ca-8abbd8681068", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:488417d9-4f32-589d-a3d6-0d0e0915d5d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:1150c1cd-a8c3-5527-921d-b63204e044c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:04b23f47-d3c0-5eda-aafa-55515a554d80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:c3fcd05c-5bb1-50c5-879f-b9e6c5d32510", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:490cd1bd-ba00-5c8c-8baf-6b6a99a114c7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:6079ab8f-3401-5c2c-936a-0e55fffb943b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.13-tuxcare.1 of dompurify, and is fixed in 3.4.13-tuxcare.2." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:c87e0e1c-acc9-5d7d-8cc6-459f04fc1c62", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.13-tuxcare.1 of dompurify, and is fixed in 3.4.13-tuxcare.3." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:98c40608-27b3-5d26-ac0d-95b7c7b842b9", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.13-tuxcare.1." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:e92ba578-c69c-54a8-9bb3-1a69b01ed8f2", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.13-tuxcare.1 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:a068178b-5f1a-58d5-a533-dba66eb756a9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.13-tuxcare.1 of dompurify, and is fixed in 3.4.13-tuxcare.4." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ], "bom-ref": "urn:uuid:95c675ec-9c3f-5a22-b30d-fb07b8cfffed", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.13-tuxcare.1 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.1" } ] }