{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:97536742-7c22-5947-9115-19f46e5f1f9b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.15-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.15-tuxcare.1", "version": "3.4.15-tuxcare.1", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.15", "type": "library", "version": "3.4.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:0e978c49-85e8-5ae9-bc5e-26d4738475be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:0dd16db6-2a6d-5621-9975-1c687c74e47c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:740d768d-d434-5d61-9d10-a7bcaa680747", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:a1f928a1-f937-50c0-abbb-c99ac75a13de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:529cee17-0b10-52bb-adc5-f06a0213d5c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:1c28b09c-fdab-5bd1-b9c3-61d1f65dfc5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:230ca0d0-5b11-580e-b8d2-6ea274bb79b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:941a04ef-fc0a-5835-89b5-16c875f19016", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:389f5fcf-f617-57bb-9f61-7cc56f982f52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-109344", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:931257ca-a049-5652-94eb-77f6f26d3571", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109344 is fixed in version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:eb83e194-cff6-5d75-bfed-fb3b466477d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109345 is fixed in version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:33064990-28aa-5130-a891-5599b98d731a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:a8ec0948-b00d-5810-baab-3d092181c240", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.15-tuxcare.1 of dompurify, and is fixed in 3.4.15-tuxcare.3." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:fdbe2842-8d33-5744-acfc-101d946bc9b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.15-tuxcare.1 of dompurify, and is fixed in 3.4.15-tuxcare.3." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:bcd16df8-bee2-5942-aca1-cf18163a9f44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:40ace0b0-3189-56fc-a229-562dec88ef79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:49bf204c-cf9c-5d59-93ce-a365001fc9a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:13b8f6da-b74b-5b3a-8ebc-4770172a6ebb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:d0ae40f1-e895-52ad-8bc4-b93fa8debc0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:cb806bcc-42d7-5f8d-8d37-2359395fbcdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:560b477b-4ff8-5ed0-8214-5e85d875388d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:531ab77a-7de4-5610-833a-dac0091fc9a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:2f285f35-a031-568a-8191-c9cf524f040b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:3629265e-75b6-5ed8-a40f-6735208fa128", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:7b7166e8-8e40-5dd9-8f4b-d1a1f0878834", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:105f6298-8051-5bb2-8b7f-242470870029", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.15-tuxcare.1 of dompurify. not_affected \u2014 The target DOMPurify 3.4.15-tuxcare.4 is NOT AFFECTED by CVE-2026-65902. The defense against hook-driven allowlist pollution is present at src/purify.ts:3067-3076, where ALLOWED_TAGS and ALLOWED_ATTR are cloned before being passed to uponSanitizeElement/uponSanitizeAttribute hooks. This prevents permanent widening of module-level default allow-lists. The fix was authored by Cure53 (mario@cure53...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:e1065812-ae07-59c1-947b-ba8c559bf287", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:c8a33860-72c8-58ed-8985-6733b7a33f33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:58076817-922a-579c-be24-62319fdb9713", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:11c58e44-5de9-59dd-9a8b-33290a1eb0a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:66e76cc5-849c-53e6-8d24-12eaa5643f59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:b5234965-435c-50f8-9f61-c8f126dfe7a4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:46b76fb0-0b5b-55c4-a9ac-0200dd05ac57", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:5c179fc0-faef-5dc5-ac6c-0e0aecb45377", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.15-tuxcare.1 of dompurify, and is fixed in 3.4.15-tuxcare.2." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:36df3e57-855a-5bba-aa28-34553687f2e9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.15-tuxcare.1 of dompurify, and is fixed in 3.4.15-tuxcare.4." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:2dfe4621-f110-5e90-bbca-a19875dc7f5c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.15-tuxcare.1." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:d449ed7e-147b-5638-a48c-b82220083d25", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.15-tuxcare.1 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:90127482-2c1f-5256-bca0-78d89fc76f29", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.15-tuxcare.1 of dompurify, and is fixed in 3.4.15-tuxcare.3." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ], "bom-ref": "urn:uuid:87e63e63-c900-52d0-8bc6-3a40deaba4ee", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.15-tuxcare.1 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.1" } ] }