{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c339d72e-282e-574e-b3e5-eb9f370e5283", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.13-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.13-tuxcare.3", "version": "3.4.13-tuxcare.3", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.13", "type": "library", "version": "3.4.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:6bfa9b4a-a573-50c2-86f7-024bf21ae69c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:7fe5a84d-d66c-5a55-8c02-2b1f92745be8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:fee6c266-551b-5f2d-a5a5-e3084b8898f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:257908ba-8f7f-5869-866d-e886fcfcc593", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:abfd069f-872f-5192-8ef1-cefd8217def4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:9a4612d7-2ef7-5279-93de-889fd703653b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:c415763b-eecf-52dc-bf37-b794163336da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:4bfa0a34-e84b-58d2-bb58-1c82a9a81d58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:796e18f8-4769-5fef-9bdc-8bd9565da3ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-109344", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:b9bc81d7-e360-57fc-adb8-d73ddb657048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109344 is fixed in version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:a63302af-4880-59f4-b8ad-6ed6b7273776", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109345 is fixed in version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:9ff4a518-981d-523d-8875-9ecfcad2a5bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:3faff404-5df9-5d55-9a8a-7d2263edbc0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:a5a5ce2e-0fdc-5ae0-b14f-67ff92fa4a44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116804 is fixed in version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:96d88b92-d41e-56ae-b914-496e2417b4d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:10d03b9b-c601-57d6-9e17-d6cb84db9618", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:e4fb1965-5264-585b-a1ee-6d3c1b4984e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:1bfcc18e-4e78-584b-8daa-d1cec1249855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:da6e7eb8-90be-5e1d-a20d-d4b2318e665a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:ba642aac-ef6e-5a33-b44e-1e34cea6f3fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:2a7872ae-644f-56ef-bc0d-dd991c53f6c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:5e76e501-976b-50ef-a309-811303a356f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:b035abec-5629-56d2-b7db-458aaae1ac5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:f68bd9af-5aaa-59bc-acd8-6a18fa170190", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:3c5e62ab-1c91-5348-b47c-b0c60385d737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:c91653da-536e-5d74-8ec6-01139446fc67", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.13-tuxcare.3 of dompurify. not_affected \u2014 The target dompurify version 3.4.13-tuxcare.4 is NOT vulnerable to CVE-2026-65902. The vulnerability (hook-driven allowlist pollution) was fixed upstream in DOMPurify 3.4.7, and the target's base version 3.4.13 already includes this fix. The _forkSharedAllowlist defense mechanism is present at src/purify.ts lines 2167-2178, which clones ALLOWED_TAGS and ALLOWED_ATTR before exposing them to hook...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:ae66a5eb-7855-52f8-aece-4f91bece395c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:1605f657-7ba3-5f90-a5c6-c263f3141ba1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:3a24fda0-5fbd-528e-89db-1707b136913c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:85788a85-bd51-5810-b6a0-de812b334d29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:462e82ca-b6a1-5b10-95c7-827721b1ae87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:dc974c21-a17a-5339-b344-ed6be325fd28", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:7a3f07b8-eaa1-5a82-805f-de85f0e76547", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:bc75dbcb-39da-59a3-ace6-d4e3e723aa42", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:13588639-808f-558c-94b2-5872aa2954c6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 is fixed in version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:62cbcb50-2b05-5dc6-be04-fb1e9dd7b152", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.13-tuxcare.3." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:df98905f-78b1-5a3a-9377-b45eac5a8cfe", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.13-tuxcare.3 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:59251ad9-ef79-5238-a70d-b42a295f7170", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.13-tuxcare.3 of dompurify, and is fixed in 3.4.13-tuxcare.4." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ], "bom-ref": "urn:uuid:e05147b3-9f47-5e92-84d4-90c246119768", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.13-tuxcare.3 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.3" } ] }