{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:69db746c-ae2a-57c5-adfa-1cbfc2de9d5f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.16-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.16-tuxcare.3", "version": "3.4.16-tuxcare.3", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.16", "type": "library", "version": "3.4.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:91f5ae60-98ff-5a8c-960c-4387e9491c88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:6e920174-21f7-5a27-8ea6-a10d2bb6a86e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:3bb0fe4e-b5cc-595f-943a-06d6c6096ebf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:9d04eabc-ce8a-541d-82c0-fe71ce55bea3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:31b5b6a5-195b-5c12-9dac-f2f5e1d24ad9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:d3ea8a65-4dd2-5443-afa5-0a4115acae3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:56bbf2b9-becb-59c7-a3d9-986a19628dc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:fc1ba4f5-e315-59b7-bbc6-7d0da5a4126e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:b46a03ca-c2db-5fe3-9833-f61f3bce87b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:f0815137-773e-50f1-98d0-39b25e257d03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116802 is fixed in version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:9e6da2cc-d2c6-59c6-9ae5-e4874025a855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:6644c1a9-0f85-559e-9a74-995de0572155", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116804 is fixed in version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:334afa55-68be-5456-a4fc-bdc369678aee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:2e112935-9f25-5c86-964b-2a19f52b7803", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:d223d52e-4a7a-5a8e-8a95-4a2bab3b5435", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:0351dd44-1ada-567d-a7f2-90ff4ba696ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:b39a43dc-e3ad-5298-a742-d3f05bb8263d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:a0c6784c-7a3c-56b5-9488-63b4a5663d5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:e6120186-0744-5942-843e-7c40f3fef0e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:df180be2-72ef-5a37-8216-8838ede67325", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:f02d2739-eb55-5ba8-b137-a864484cb242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:70f0099e-2ad3-5733-b3aa-b0d47d44e0c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:ea911b4d-ff2e-5b11-899e-4d93ac7c75fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:ab70b252-2d25-5342-bec0-76e422702859", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.16-tuxcare.3 of dompurify. not_affected \u2014 CVE-2026-65902 is not present in target version 3.4.16-tuxcare.3. The upstream vendor (Cure53) fixed this vulnerability in release 3.4.11 (commit 0cae51874) by cloning ALLOWED_TAGS and ALLOWED_ATTR before passing them to hooks, preventing permanent mutation of default allow-lists. The fix was already present in the upstream release that TuxCare onboarded, so this is an upstream fix, not a TuxCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:e0624624-2fb8-575b-bbd6-726cd282f164", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:2256e697-28d6-5476-ae75-429fa3076be4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:ca5da358-4519-5f11-890d-1f2ab47701cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:1159b78c-5dcd-57d0-a3b9-210510210256", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:1a48ca88-8ca4-5738-8082-ed240a3818dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:32c471c8-ee0f-5c6a-8842-113691296d12", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:e9a2b693-1cb4-5759-af1e-c485ede5e728", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:6988604f-baeb-5042-923d-7becc2f7e62d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:c3148ef5-cdf5-538c-966a-ddffc7ce511a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 is fixed in version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:655c3299-69a9-5120-b06c-a2f0ae13f8ec", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.16-tuxcare.3." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:47c3e8a3-c84a-5fad-aafd-b000f2f76334", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:5fe77aa7-1571-5b5a-bb4e-288cee0a47d7", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.4.16-tuxcare.3 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ], "bom-ref": "urn:uuid:1b0d26ce-8d9d-505f-bf1d-428fdf057fd8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.16-tuxcare.3 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.16-tuxcare.3" } ] }