{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8a609d90-0c8b-5774-9ed6-d5a36a49ab94", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.13-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.13-tuxcare.4", "version": "3.4.13-tuxcare.4", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.13", "type": "library", "version": "3.4.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:636f8ca1-e5f0-5907-abf9-3e0ac8aaf113", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:977ded92-f4f7-5361-9286-4405303ba0a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:6882aee5-cca8-5a08-8f64-dcb16aab7102", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:fdf6fba4-ba37-5891-9b0b-d1cfd303fa9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:b8969b19-a564-5b28-a948-4a5116abf2eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:da85d818-d707-5733-99d5-aace4800fec1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:809f31b8-2a18-5d30-864b-c6d432dd93d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:4c3a8039-25ca-57cc-8d16-60639eb850dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:7edb1f15-eab0-580e-957d-c3ea946e34a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-109344", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:e8d0eff1-4ab8-5b0e-8473-fb0732da1e4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109344 is fixed in version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:d507752d-31b9-51cc-ad54-2174847685a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109345 is fixed in version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:882e17db-4a23-52d4-b15f-0f293de636cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:75050a59-4404-5a7e-91ef-176cdc269f08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:7427e9e3-6c8b-5e65-ae65-cc9f98db587c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116804 is fixed in version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:b8946a06-ce20-5b4a-b995-0f82eb086f9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:3cbdee2e-256d-531c-ae79-1738f2f0550a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:6fac1fca-ef82-5f25-83d9-da29e950ad9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:858737a8-df6f-5d55-b902-e63a0a2eec19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:61f6e342-5d40-5244-b9cc-697c7cafd6e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:62b609cb-df87-511f-8803-0efd7ffa7b9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:623f77e9-6ab8-54e0-b3f1-2c33aef113dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:2795e800-9224-5b5b-a8f7-63d46def493e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:e06af5e8-d6d4-5cb8-b4a7-22a2085ce8e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:621cf9cd-01a4-5122-a57f-b8a1579b3c15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:40a8845a-3529-5809-a453-9fa22609e722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:72e5362f-a096-59a9-9faa-269ec46782fb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.13-tuxcare.4 of dompurify. not_affected \u2014 The target dompurify version 3.4.13-tuxcare.4 is NOT vulnerable to CVE-2026-65902. The vulnerability (hook-driven allowlist pollution) was fixed upstream in DOMPurify 3.4.7, and the target's base version 3.4.13 already includes this fix. The _forkSharedAllowlist defense mechanism is present at src/purify.ts lines 2167-2178, which clones ALLOWED_TAGS and ALLOWED_ATTR before exposing them to hook...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:7d5eff20-b82e-5f42-ab0b-f8c44e5ec013", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:a25b4152-5bb3-5b59-9f67-5ae0a6f5274f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:c9727338-a43a-5b97-b05f-8b7665138c04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:d1f88b77-559a-5e8e-8466-f69535c4d517", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:900056fb-4531-5ccd-be2c-d2aa6127bc12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:8a8ad3de-dabb-5741-95c7-9758d8b0df49", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:ef52f499-c597-5c50-a241-80be7c09cab2", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:e5c1c5a2-5e63-51d3-98d5-38da5e7e1e49", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:5130f0a9-178e-5642-967e-14b930c342e2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 is fixed in version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:93557392-d5d9-54cc-a5b1-9d30028fb0a1", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.13-tuxcare.4." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:8e28a677-74d2-5308-bbc2-803a54c66db3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:b9dd52b3-4af4-560b-9246-31f4cc0b8c22", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.4.13-tuxcare.4 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:dc14432c-3dd4-53d2-8b22-5c7120575915", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.13-tuxcare.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.13-tuxcare.4" } ] }