{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2cf5aebf-799e-5a53-a9e5-737fd46fc75a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.4.16", "type": "library", "bom-ref": "pkg:npm/dompurify@3.4.16", "version": "3.4.16", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:d7dbcd9f-a38e-5df8-bc76-09b2aa83ec98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:15e2a68e-884a-5d00-8d5a-1707c6960299", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:3fed9bdb-df7a-59c2-8655-979013e7c642", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:72cd0c22-61ea-51ec-915e-211ed2188fc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:3c2cb750-bfa1-5b09-865a-631e6fbdc21a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-47875 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:53321da5-b67a-5da7-8a5b-1c32bf11169a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-48910 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:03e9d02f-52b2-5b9c-8cd6-837e0cba8295", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:e889faff-26e3-5ebf-9d46-bfbfca26ac72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-26791 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:eded8957-cffa-5ac2-b732-acb437c47bd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:a649692a-c6f8-5a95-8ff9-c7ce6e099ae9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.4.16 of dompurify, and is fixed in 3.4.16-tuxcare.3." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:033f5ae4-c0b4-5e95-94dc-199da08edc50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 3.4.16 of dompurify, and is fixed in 3.4.16-tuxcare.2." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:93f370ba-ab23-5f4d-ad87-ff252171392c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 3.4.16 of dompurify, and is fixed in 3.4.16-tuxcare.1." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:42a4a4cd-5dbe-58ad-ad8c-85143c4aa4c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:41f86b31-ec56-5e2e-8a2e-7cbb442ef4c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:0ffc0f1a-be70-5850-b03f-b4f1a720d93e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41240 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:261251f4-655c-5f47-8524-6f6f5d743e37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:76059def-2a35-5d25-ada5-7b8474901320", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:fcf0544c-496c-5b9a-b626-84826e1bc757", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:f2a53382-1914-58ac-a2b9-f20fe1619f8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:b9db289e-6348-5fc1-a032-a06bf6ebd8b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:cb67a983-2f3f-53e2-8462-9b04b79e89be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:cb65c116-a6ff-5ecf-9252-007dbe5acdec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:22036341-2488-585e-b1cf-3cca908189ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:da186565-99d1-59a0-9f56-63db4786bba2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65902 does not affect version 3.4.16 of dompurify. not_affected \u2014 CVE-2026-65902 is not present in target version 3.4.16-tuxcare.3. The upstream vendor (Cure53) fixed this vulnerability in release 3.4.11 (commit 0cae51874) by cloning ALLOWED_TAGS and ALLOWED_ATTR before passing them to hooks, preventing permanent mutation of default allow-lists. The fix was already present in the upstream release that TuxCare onboarded, so this is an upstream fix, not a TuxCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:8b5125e6-6022-5e45-8521-aef5d538137d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65903 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:f57f5b88-328e-58d6-aeb2-3ef5247b19ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:355f46b5-6bd3-5a5a-b1db-af071011c3df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:405fc594-4d6c-5794-9903-111af0496a07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.4.16 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:1e811177-22ec-5aba-9123-65bbde3dc417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.4.16 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:99e318eb-2347-5485-a37a-1439a4787c8a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.4.16 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:2d20793d-f34f-596c-9cb2-fe3cfae53066", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 affects version 3.4.16 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:c58bc4fa-0b6f-5499-b0a1-b267904b775a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f affects version 3.4.16 of dompurify, and is fixed in 3.4.16-tuxcare.3." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:218c861e-eb32-5b4c-9f05-bebc5bf5918e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 3.4.16 of dompurify, and is fixed in 3.4.16-tuxcare.1." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:a5859332-0b9f-5de1-8a9f-63511605ee3c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.4.16." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:3861d6e5-5d52-511f-84d1-0c172c8ae655", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 3.4.16 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:2de39d9c-9cc2-56ad-b99a-25e019cd1a9e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr affects version 3.4.16 of dompurify, and is fixed in 3.4.16-tuxcare.2." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@3.4.16" } ], "bom-ref": "urn:uuid:bdd5abac-cc87-5c91-bf39-898c8d7cbcb4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 3.4.16 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.4.16" } ] }