{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fb06038d-3f0b-53ff-8551-d66dfe28f4a9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.13", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.13", "version": "3.4.13", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:9e950901-9f04-57ed-84ae-b54da9c77ed2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:d35d5803-3832-5d38-a936-941c49a3af87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:5d9d2e99-ec9e-5112-a34e-6cac3826f1ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:95bf7768-8503-5259-9968-46ef45ba6718", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:fd8f5e5c-8723-5e8e-8ea3-79edcf18f01d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:4f10aac1-7bdd-5b49-b508-53bde7c91472", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:dd56a475-d08b-50a4-b67c-961c62412c25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:08d4f9d4-7588-5f8d-919d-1bb9aba4a24f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:761459ad-c9fd-58bf-bca9-c18c3fa7c9d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-109344", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:0889ceac-495d-588e-887d-081e3f39e754", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-109344 affects version 3.4.13 of dompurify, and is fixed in 3.4.13-tuxcare.1." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:1070d25f-fc94-5b6c-89de-ac1b4a96b06b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-109345 affects version 3.4.13 of dompurify, and is fixed in 3.4.13-tuxcare.1." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:4e3020a2-dad8-55db-a95e-fe618f0fe864", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:b979eb52-25dc-570a-86cb-4b72a574053a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.13 of dompurify, and is fixed in 3.4.13-tuxcare.3." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:301557ce-4025-54e7-b7a8-4e94bc8ee039", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.13 of dompurify, and is fixed in 3.4.13-tuxcare.3." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:8863a8ca-ba38-52bc-b202-762d869e6bbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:b8acbeec-affa-5b27-b860-f095eafde15b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:0b0ac9e9-b837-5daf-bfe3-8d966d0b3e1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:141e8ba3-6d54-57a7-b195-d2590d39b46e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:6386eca4-ed01-54e3-b316-189657dcf429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:6adf34a3-4d5b-5df8-ab5d-aaded0fb2e72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:4a56b89e-6bba-5da3-9249-52f9cf5fea75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:92553b8f-8b91-5f21-8bbb-1aef036fd945", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:b1801d96-376c-57db-9e3b-6b2c89312e7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:fa4628d0-b1f3-5e7b-974d-b237301dc321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:0283f66f-5153-5a5f-ae70-c2d66ca127ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:06e8c97c-012b-5db5-9a5f-61b2eeaf4c31", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.13 of dompurify. not_affected \u2014 The target dompurify version 3.4.13-tuxcare.4 is NOT vulnerable to CVE-2026-65902. The vulnerability (hook-driven allowlist pollution) was fixed upstream in DOMPurify 3.4.7, and the target's base version 3.4.13 already includes this fix. The _forkSharedAllowlist defense mechanism is present at src/purify.ts lines 2167-2178, which clones ALLOWED_TAGS and ALLOWED_ATTR before exposing them to hook...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:0c8492c5-5f80-5c08-9347-9e9d4b6528f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:3aa17e79-a0b5-57e3-810f-ffd8f5919623", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:2b1b2df9-c5e4-5d15-ba88-b858f7602588", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:954ff4b2-de03-5139-b73d-0346faf43c5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.13 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:18d06ba5-1e04-59a1-905b-5ebed61daec4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.13 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:5d5d4730-820e-58f6-84db-7f5b61fa4e5b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.13 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:57f23561-619d-5fbf-947a-93c75c2fc74b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.13 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:808ad410-8e4f-5053-a7ab-e046637cc84e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.13 of dompurify, and is fixed in 3.4.13-tuxcare.2." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:cac0fb84-978e-5623-89bc-ba26608c86c4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.13 of dompurify, and is fixed in 3.4.13-tuxcare.3." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:13459dd7-f013-5f28-9dfa-fcd5fc51c0b5", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.13." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:1d4db4be-7d6c-5d38-a875-6b9d0df4a572", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.13 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:b58e9198-8f8b-5807-9e1f-e36ecc489fcb", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.13 of dompurify, and is fixed in 3.4.13-tuxcare.4." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.13" } ], "bom-ref": "urn:uuid:7831382c-6992-5d5f-b3aa-e92eefc9c121", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.13 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.13" } ] }