{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ff6a107b-730f-5d85-8d42-ef19b78739ac", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.14-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.14-tuxcare.4", "version": "3.4.14-tuxcare.4", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.14", "type": "library", "version": "3.4.14" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:797b0c4e-6fdb-5438-9f13-abdfd8543ae6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:da4f2a4c-b908-5302-a616-e22261058444", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:79fcbd1c-4d2d-5391-a8a5-6ea595ffef4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:2a14d5ac-dd20-5f5d-8bd9-9123580b7a7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:1e073395-f272-561f-bf53-4e17891f3275", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:53acfc30-5942-507c-a8f5-6c2adc9a7484", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:6c695467-084f-5ab5-be90-116097ec1c4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:fad39a36-69a6-52cc-af01-31a2dc85ec34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:3bda617c-fbdd-56bc-9e4c-86c4a1e5b594", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:527689b6-bc87-58b7-a0f3-15741859409b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:bc731aa7-8aa2-51fd-b855-495823902aff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:97ff4848-ecaa-5426-9143-5d43f4062e54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116804 is fixed in version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:d7093d6d-359b-5ab4-913d-00b2aae7268f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:fa3b45bb-8b9a-5c38-8a04-fa95e8de6d4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:589123be-7070-59c0-afed-cc19b2225916", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:b4d6dd51-67b2-509b-b227-69bd4136a0d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:6178f22d-96e1-55e1-83ad-374f6f967b79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:55f51d6b-c0a3-5bd7-b6dc-56937d70c2bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:9cbffa92-dc6c-5c9a-8ce9-1723c074dc54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:9590c15a-348a-54c6-a87c-c733c5b4d718", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:8f9b4a40-7ef0-5002-bf24-6145495d171e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:c0153d08-7163-53ca-85a0-cae312eca3e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:3ba8369c-38d9-5a14-b154-0a7e7157e3c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:61f0e76a-4fc4-501b-b2df-7ede767e03d8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.14-tuxcare.4 of dompurify. not_affected \u2014 CVE-2026-65902 does not affect dompurify 3.4.14-tuxcare.5. The vulnerability (hook-driven allowlist pollution via direct mutation of module-level DEFAULT_ALLOWED_TAGS/DEFAULT_ALLOWED_ATTR constants) was fixed in upstream DOMPurify 3.4.7. The target version 3.4.14 was onboarded from upstream with the fix already present. The fix clones ALLOWED_TAGS and ALLOWED_ATTR before passing them to uponSan...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:5051c20a-14be-5482-a12b-6811d78f721b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:b5e6bc7c-f470-5897-8bd9-e4796b077661", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:2bade8ac-9bfc-5b5b-80c9-baa3ebe291e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:db129231-9843-50f1-8d67-4ecdc44e4bb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:137df628-d420-536a-a324-b3c0b2b043be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:2f469273-fa91-55fd-97e0-828d93f7312b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:d17547b2-5ce2-53ea-a5b6-d8b1af41f5f9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:77e46a12-e070-5079-aadb-b913ef021a53", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:f9804ffc-3423-5dad-94a8-0e51757fa4ca", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.14-tuxcare.4 of dompurify, and is fixed in 3.4.14-tuxcare.5." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:4658f05e-045a-51da-8746-297030274b48", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.14-tuxcare.4." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:dda29c83-5870-50c7-83d2-d85a5c51d728", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:204d8cc2-13c8-5379-9297-5a81ded276cd", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.4.14-tuxcare.4 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ], "bom-ref": "urn:uuid:19afafb0-c310-5d7f-ae8d-36bc043fd490", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-p98j-92pf-mc4p is fixed in version 3.4.14-tuxcare.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.4" } ] }