{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:52c9caaa-4338-5486-82fd-601a7b4033a4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.16-tuxcare.1", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.16-tuxcare.1", "version": "3.4.16-tuxcare.1", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.16", "type": "library", "version": "3.4.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:84840f57-2e86-5d9d-a771-0741f3d9f9b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a3480689-bc2d-5722-9c95-4ee9b0925457", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:aa72ea60-0fd0-5236-8267-0771ec6f6e51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:63097d67-aa4f-5c95-8f1b-010ac0df9eec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:6183324e-7459-55a6-adbb-ae606cc49694", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5f062204-ac6b-5bf6-a3ac-832dd9ef8dc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3205772e-132e-5d4c-93be-4fc68b0f3a34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:20a7d083-1745-524b-8e28-9f78fbcf4a24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:33276b76-242c-5ede-879e-4ab9e0e33810", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5cf05bc5-8802-59e7-811c-6707559e005c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.16-tuxcare.1 of dompurify, and is fixed in 3.4.16-tuxcare.3." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f4431eb8-d192-5240-a1f2-f3aa9c6c338f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.16-tuxcare.1 of dompurify, and is fixed in 3.4.16-tuxcare.2." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:c5de9eab-4e5e-54e1-9c18-6cb48ab6bef0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116804 is fixed in version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:321cbc5b-2db3-5df2-8d0f-6d3fcb49e5f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3b583c8b-251e-580f-90f1-8c9113f83538", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f7406124-a60b-5f1f-9912-2ed01f5c7691", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d409d513-181b-5ffe-acd8-ca211cd357aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9fe024b2-5154-5bbd-a88f-ebd03ba16dba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cd9510f9-9599-5e9b-8704-644adf745f92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:31d9b8a4-ec4c-5d19-9b2b-f1403737201e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:71ea1fd2-5f6a-5d9c-818d-1be6e9b68d7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:92c97f8d-bcda-5b79-8fa6-453a9c7b4807", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:3fba9eea-4dca-5014-9e69-637f829dc656", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:4eaeae1c-97b8-5f0d-8404-351d54679ace", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b1d1be90-6faa-58ac-8876-d00a83bf6d27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.16-tuxcare.1 of dompurify. not_affected \u2014 CVE-2026-65902 is not present in target version 3.4.16-tuxcare.3. The upstream vendor (Cure53) fixed this vulnerability in release 3.4.11 (commit 0cae51874) by cloning ALLOWED_TAGS and ALLOWED_ATTR before passing them to hooks, preventing permanent mutation of default allow-lists. The fix was already present in the upstream release that TuxCare onboarded, so this is an upstream fix, not a TuxCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:5d17215b-8f0f-52fa-a6ad-9b8cc9a83edd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:521255fd-d18c-5655-88e1-a1fc273a5002", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:53652f45-3ce1-50ff-be40-931c8d070f47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:9b44a33f-ebe5-5205-ad12-a00067e0d78d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:d3c17c31-a02f-53bd-8c59-65505bbbbe82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:f6cef63a-83af-5e13-9fb3-cc521ba84b07", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:cd568073-da45-56ad-b12b-5797a3b0cf0d", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b3685b56-0190-50f5-b6d7-19e5ef5d36a4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.16-tuxcare.1 of dompurify, and is fixed in 3.4.16-tuxcare.3." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:b1088581-1cbd-5e41-8e83-83f07f43ea09", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 is fixed in version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:a8de5d26-8795-5ced-a0dd-4e75b3e60479", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.16-tuxcare.1." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:ae245a6d-1057-506b-9c3c-81e9bfb80c1d", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.16-tuxcare.1 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:07ff7201-09a7-5581-8fca-d4a87994ae70", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.16-tuxcare.1 of dompurify, and is fixed in 3.4.16-tuxcare.2." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ], "bom-ref": "urn:uuid:afd6abcf-f9c2-547e-916e-62b8be363e0e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.16-tuxcare.1 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.1" } ] }