{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cc1700ec-64e2-51de-99fc-392190061020", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.16-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.16-tuxcare.2", "version": "3.4.16-tuxcare.2", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.16", "type": "library", "version": "3.4.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:3492df51-51f5-52ba-b4d5-2c7bb88fc346", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:109011c9-ec2f-5138-8e83-b389e6357266", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:4cf05194-5f2c-50dc-a94d-a9770d4e4d60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:3861e144-a6fd-5032-a709-659b9735ff5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:defbfbd0-305c-5395-b062-e2caff7e474b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:4dcf5f14-108b-5023-8681-3d8691b4a984", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:3ea713e5-117f-5e43-9bd8-0c8a331755f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:1da29b1c-817c-5751-b182-6211183e9367", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:aa9e1429-a09a-5840-aac2-62eba931640e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:c87f3429-6a34-5d14-87d2-6ce3d9f1be58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.16-tuxcare.2 of dompurify, and is fixed in 3.4.16-tuxcare.3." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:770356f2-872f-5d9d-832b-4c42b4d6b761", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:a4596776-962c-52e1-be9d-58ebbc2d1c94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116804 is fixed in version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:61a8c5d3-1d4b-53fa-b8a7-5c833752d799", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:113ecafd-b32a-5b54-ac1b-178c384f7beb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:fc0355c7-f1fd-573a-8876-8a4fc3d39060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:e28de99c-673c-5668-a8b1-0226c5ddc673", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:4937aa81-0850-500d-a637-c91846d1c9f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:e46e8539-473d-5923-aaca-a02cdef9daeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:2b3481a0-0d99-5e5e-a027-ef22748819c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:114c080d-48f9-50cc-9feb-a287d452cd07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:35735879-b07b-5022-9d92-a6d0946d4016", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:1d31adb9-9e00-55c3-81fb-6641e9a8f05d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:53e9d633-4d53-58d4-83d6-0a4f42dbe580", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:d39f43e3-96ec-5764-8e09-b40c3daae7f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.16-tuxcare.2 of dompurify. not_affected \u2014 CVE-2026-65902 is not present in target version 3.4.16-tuxcare.3. The upstream vendor (Cure53) fixed this vulnerability in release 3.4.11 (commit 0cae51874) by cloning ALLOWED_TAGS and ALLOWED_ATTR before passing them to hooks, preventing permanent mutation of default allow-lists. The fix was already present in the upstream release that TuxCare onboarded, so this is an upstream fix, not a TuxCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:8ebca727-871b-5877-b31b-6dace4aae92f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:4adb1a94-c053-58e9-8c33-8048500607b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:629b3e22-49bf-5b01-9371-608bf2f89804", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:263597cd-0582-5e32-9309-16c43b29700d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:7cdf6ae4-742c-5d1d-babe-6ac318539634", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:9a8768fd-52b4-5224-b3a2-feea475924d8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:f7e0b1aa-70eb-5c7f-bad5-3bec8d045fba", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:0cd04093-6666-5442-9f0f-92e8e7c99abe", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.16-tuxcare.2 of dompurify, and is fixed in 3.4.16-tuxcare.3." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:d283e4fe-815b-54ad-9362-c7f443fb2f9a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 is fixed in version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:f5b54231-3e2a-5a9b-8f31-6d301ab32a29", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.16-tuxcare.2." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:93153326-4d40-59db-aadc-1247c63d9b21", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:26994203-41ad-54c1-a81c-74e3de6676d9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.4.16-tuxcare.2 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ], "bom-ref": "urn:uuid:e5f4bbc5-7ffc-5fde-8528-f28fb1cb954c", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.16-tuxcare.2 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.2" } ] }