{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:12b6d8ab-4794-5f02-82e6-ad31f06705d5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.14-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.14-tuxcare.5", "version": "3.4.14-tuxcare.5", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.14", "type": "library", "version": "3.4.14" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:4f60829b-61f5-5a36-a309-0b64c7712c60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:8a8ea20d-5500-56eb-b639-14de4487392c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:367cd167-e1bd-5bb1-9035-9520fefad8be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:db61c109-05ee-5e4d-9f55-99f4166e42e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:1987adad-579f-5d10-aedf-21a20a1087eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:1cf93539-4616-52a7-b46a-d56efa08ebda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:a2b3bb33-b3d3-5741-9a96-9ecd6162ac51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:e95c0c4f-7d9e-55b2-a4c3-ebc44cda1909", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:2c50c2c8-d295-55ae-881f-997f2ed41de5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:f425db8f-6a96-5be8-8083-ef7a69d4b8b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:651a6f26-7688-522d-bb33-d6b2a47d2ab8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:deea2e00-8a39-57c0-9f30-96b6b323dfd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116804 is fixed in version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:1e9f0e57-04a6-5c4e-8d66-8f6fecc4e8f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:566423b2-7537-5e89-ae0c-165afe1dae65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:4d1c37ac-bf45-5208-9fad-6b447544790f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:ce2f261f-24e0-5e53-ac95-fceb63da5316", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:3333c915-56ed-5829-a6e9-6f0dbb4cc338", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:b0682352-84f4-59f3-9501-d6c64cc3406a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:ef4f298d-83d1-56c4-9851-f76ff960c1f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:afdf2917-6f27-5d74-9095-14f96029acb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:8c9fa3c9-6942-5894-a0bd-6766fa135b7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:5ab59a4f-6e48-5cde-a667-ab9e043cc002", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:2b4839f4-3444-5aab-9c21-e95b3ea354a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:2d053464-de6d-5d11-a13b-35e191e0a76a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.14-tuxcare.5 of dompurify. not_affected \u2014 CVE-2026-65902 does not affect dompurify 3.4.14-tuxcare.5. The vulnerability (hook-driven allowlist pollution via direct mutation of module-level DEFAULT_ALLOWED_TAGS/DEFAULT_ALLOWED_ATTR constants) was fixed in upstream DOMPurify 3.4.7. The target version 3.4.14 was onboarded from upstream with the fix already present. The fix clones ALLOWED_TAGS and ALLOWED_ATTR before passing them to uponSan...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:3d8df4cd-13cb-57ff-8c58-ff24a6f2a911", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:8d751a56-cbb1-5a3b-bfe3-4320525a54da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:6bbdfefb-dd6b-5eee-89f1-00f38a9fcc90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:1f7768a7-fb7e-516f-a1a8-554382fd7429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:b41b8488-8142-57d1-afba-f36bf32bd2d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:375a9db5-17ed-5ac1-a5c2-479fe9befbe4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:cde60b6b-5e22-5598-9164-ed6022e20874", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:7ed56517-4009-5bea-8f83-9c7a79a896ea", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:36c87125-7b56-58ed-84be-4674d7646841", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 is fixed in version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:a8619d23-d43f-532f-afa4-c314f6d70f5a", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.14-tuxcare.5." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:e4de3521-2a72-57c8-b8f6-fea400a045ad", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:d8ecdbf4-3b76-5556-a41e-2c5f8d52abd0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.4.14-tuxcare.5 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ], "bom-ref": "urn:uuid:4edccac7-4ee0-54b4-8b95-73996e9d002d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-p98j-92pf-mc4p is fixed in version 3.4.14-tuxcare.5 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.14-tuxcare.5" } ] }