{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e7c75451-fc09-5138-a6dc-a113f73b59a3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.14-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.14-tuxcare.1", "version": "3.4.14-tuxcare.1", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.14", "type": "library", "version": "3.4.14" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:5678c101-ba06-51b8-9093-8c9a82ecc067", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:b8f02321-8fa6-580b-a38e-f41a4eab46b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:5fabe238-ff67-5190-a4b7-7f8f6f3c541d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:d8f83097-6cac-5a22-9af6-98d3cbe85dd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:07140da1-d0c7-5637-af3e-ec6553dacd6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:0a98e42c-9de3-5234-884f-16e94b47077b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:2270905e-f47e-529e-ac6e-708d6890467f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:6bbe8db4-77a6-5348-b894-a495fac6208b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:e0a2f4c2-8a93-546c-923f-808e1b821438", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:22b39781-86a9-576e-9854-bb4de797b20f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:2527dbda-f43b-5117-8ff7-ddb2e1d318ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.14-tuxcare.1 of dompurify, and is fixed in 3.4.14-tuxcare.4." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:5e1c1420-ae35-5c94-afde-f3e5b32e20f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.14-tuxcare.1 of dompurify, and is fixed in 3.4.14-tuxcare.4." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:d91b8b20-d249-5771-8476-9e1fa083e209", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:86cf244a-d258-5f2c-9e18-f3ea849db908", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:ddd593b0-5685-5e75-8acf-e438eb99b0b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:33e0c0f5-862e-51c6-a9d3-9dcee776025a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:620c072c-0941-574a-8b00-c300b8a6919f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:ba628383-c54f-5508-b023-97e52e20b62b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:9f2bfdca-fb68-5756-be9b-254793634436", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:17c3abc5-bce2-5b91-96e2-e165f6538aec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:9f343cc3-19b3-507d-9d2f-3cd3fe6cc453", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:4a2218f6-7ed6-50da-adad-cb753e1b4c20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:1109190a-412c-5c2c-8b6f-dee0cad5e664", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:df381ae2-7b21-5e64-acf9-c49c66b37d68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.14-tuxcare.1 of dompurify. not_affected \u2014 CVE-2026-65902 does not affect dompurify 3.4.14-tuxcare.5. The vulnerability (hook-driven allowlist pollution via direct mutation of module-level DEFAULT_ALLOWED_TAGS/DEFAULT_ALLOWED_ATTR constants) was fixed in upstream DOMPurify 3.4.7. The target version 3.4.14 was onboarded from upstream with the fix already present. The fix clones ALLOWED_TAGS and ALLOWED_ATTR before passing them to uponSan...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:2383b430-6124-578c-824b-080d001e4b81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:f016135c-a0bb-59a8-99d4-608213977737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:2d8d19c3-f5c0-5cf9-a54e-8e913ccec0de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:a10e1919-0651-5161-93b1-109eeafcdc26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:3855873a-a0cd-57f2-94a4-5da085685d6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:a2b654c3-35d3-5cb4-8418-8e468a03c991", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:e8fc78bc-d26f-5c1e-becb-d5ba353781fa", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.14-tuxcare.1 of dompurify, and is fixed in 3.4.14-tuxcare.2." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:e251fb5c-dea5-510a-a2a9-88c0f275f58f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.14-tuxcare.1 of dompurify, and is fixed in 3.4.14-tuxcare.3." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:ae3c9895-79fd-52c3-a635-f3e6fffb92be", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.14-tuxcare.1 of dompurify, and is fixed in 3.4.14-tuxcare.5." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:95e76321-8aab-59b4-91b5-7e9bdd3b18a1", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.14-tuxcare.1." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:d2c75721-ff68-5fb5-9191-486b18615988", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.14-tuxcare.1 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:1bf09b97-4509-5b3c-bb75-5a8c418b0993", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.14-tuxcare.1 of dompurify, and is fixed in 3.4.14-tuxcare.4." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ], "bom-ref": "urn:uuid:554f14dd-b7c0-5261-b481-a446967ef2e0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-p98j-92pf-mc4p is fixed in version 3.4.14-tuxcare.1 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.1" } ] }