{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dbfacb1d-291a-505f-9d30-519db3db7677", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.15-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.15-tuxcare.4", "version": "3.4.15-tuxcare.4", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.15", "type": "library", "version": "3.4.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:b0a55f67-0051-5ddf-adb9-c74477102500", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:b2ceb50a-1cbd-5405-913a-a9a26551cff9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:6fc2a03e-fbd2-5fff-9c45-b9834c691b24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:83fc8a31-76d4-5b06-8f90-4b8ca6e91350", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:ff87e186-e3fd-5148-9756-d55ca07b2ec2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:2273753c-d0d7-5a40-aff2-2641f613473d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:4a840efb-9f7e-5b44-a9b8-921aa1f58579", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:5a02a491-4b18-5d7f-bcdc-763982571dc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:c4b530ce-74a1-5ad5-a215-59c671c700c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-109344", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:0063f8f1-9c45-5cb7-bbab-56119faf92e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109344 is fixed in version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-109345", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:a06dcdb4-a02f-5d66-b6d4-26c270e9f79c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-109345 is fixed in version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:1d05d365-159c-5e19-872f-91aa8bacae6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:794f6d84-3cd2-5e91-9773-c29ff6cda73f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:42380c86-3535-53d4-a9e7-8712b9a1a0f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116804 is fixed in version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:ca9b2f4d-8c57-5827-98a3-0382c781a63a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:40f540f1-0481-56a4-8929-6906c6880dd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:ecb82408-ac42-57b2-bc5c-44917d83e191", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:10dbde45-3da0-5a5c-8fc6-1da9add493f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:7095ec09-0db8-5de2-af25-35a76341ac68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:745f662e-7ac9-58db-a4c1-00e543dfe1e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:a9a3c011-e18f-59d8-94fb-96b2a7f479b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:31eaeaed-4b1c-5454-ab0d-26b5fb001db7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:2c4e481e-83ee-5ff2-bb35-2e79be00173f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:198f8432-20f4-50d3-860d-34546ccd0eec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:57f458ce-ae35-5461-b6d9-6f94ed47609c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:bb0d8935-7520-50d9-8d42-79b5b75c5f13", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.15-tuxcare.4 of dompurify. not_affected \u2014 The target DOMPurify 3.4.15-tuxcare.4 is NOT AFFECTED by CVE-2026-65902. The defense against hook-driven allowlist pollution is present at src/purify.ts:3067-3076, where ALLOWED_TAGS and ALLOWED_ATTR are cloned before being passed to uponSanitizeElement/uponSanitizeAttribute hooks. This prevents permanent widening of module-level default allow-lists. The fix was authored by Cure53 (mario@cure53...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:dfaf8088-4fcf-58a6-84ed-30615fec1cf6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:09c7fdb8-f315-5b15-9282-e12e0d838343", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:4e856d37-67a2-5b16-b282-27b624b9abdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:24863a63-9c02-50b5-9efa-7c8c67f0c632", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:58e0cbbb-ad4e-5a71-ac84-9da953c6b0e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:4c6afba5-4dc8-54ec-ad50-c37c8138e223", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:b1935033-6950-5798-895a-24577e59fa29", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:125d64fb-be3f-5df1-91ca-b4320227fd7a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:e2222696-b76f-5a05-975a-466dac5a73a6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 is fixed in version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:40103fdc-5d2e-5f59-b662-72ac45f16684", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.15-tuxcare.4." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:7024e949-2c72-5522-8cbe-d76204104cfb", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:28383f63-faf6-51ac-8d77-2d6dbb0aa425", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.4.15-tuxcare.4 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ], "bom-ref": "urn:uuid:fad2241b-de69-5e7c-8a34-71b851b95aba", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.15-tuxcare.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.15-tuxcare.4" } ] }