{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:97c469cf-45ab-5427-8a69-707ce969de57", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1", "type": "library", "name": "DOMPurify", "version": "3.0.3-tuxcare.1", "purl": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:81864b3b-24fd-5118-84e5-d8e3537b5ad9", "id": "CVE-2015-8861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-8861 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1e6e52a9-e6c4-5079-afb4-61dda359d142", "id": "CVE-2019-19919", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-19919 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:38e7d1f5-62a7-5510-9ee4-61493fc59508", "id": "CVE-2019-20920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-20920 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ac0ba796-10b4-5ed7-b430-b937ad54d214", "id": "CVE-2021-23369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23369 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5661cdbc-690d-57f8-8f65-a7ad8e6e79f7", "id": "CVE-2021-23383", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23383 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f68a39f9-780b-5aae-b342-6a4ab7ad598d", "id": "CVE-2022-21704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-21704 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:56dbca6e-331c-5af3-9160-68f1d0bc5f60", "id": "CVE-2024-45801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ce46b79e-b297-56d7-8920-5c63b23b5492", "id": "CVE-2024-47875", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a8643284-1e29-5269-a2ac-b495fea3d271", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4c03d7ba-a15e-522d-8c3c-a0b52792479a", "id": "CVE-2025-32996", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32996 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:023af9f7-faff-5e6f-9b88-9b689c23d3d3", "id": "CVE-2025-32997", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32997 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:39b5c154-3ee6-5fc6-afe1-a97ffaa70691", "id": "CVE-2026-0540", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:20d17aac-ed50-5847-a531-77ccada46015", "id": "CVE-2026-13676", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-13676 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dad20a67-ebdb-54da-876e-4cf18bba180b", "id": "CVE-2026-16221", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-16221 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:54b0bb92-8c55-581d-a403-3557a005413d", "id": "CVE-2026-33940", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33940 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2b1b2c04-78c0-5a4e-b45c-a73ab9f6d2a0", "id": "CVE-2026-33941", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33941 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9b53449a-1b3e-5db6-82a0-955639a3726f", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:41cb90b2-e083-5ebd-8eb7-0e99df888d7e", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:523377ee-5804-5939-8852-ac66fbf94040", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:90fba21f-a366-5d8a-97ed-2278eb1efe34", "id": "CVE-2026-49458", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ef992aae-1ceb-54b4-a0c8-41e165ae995e", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cdb5d1ac-798b-518b-84a2-e6f358603a05", "id": "CVE-2026-49978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d7223d9e-b2ed-529e-8d01-0a72a2df38e8", "id": "CVE-2026-55602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55602 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7ab546f8-1d6f-5fac-a7d9-d1b973e7460e", "id": "CVE-2026-6321", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6321 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5393dc0a-fefd-5750-801a-a39c721ee8cd", "id": "CVE-2026-6322", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6322 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:43b0407f-a9c7-5606-a69a-b204768e0940", "id": "CVE-2026-65898", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3b374e10-65fc-5c19-a006-18022262f075", "id": "CVE-2026-65899", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a6ddcc7f-d3db-5e63-beb8-287cd182e624", "id": "CVE-2026-65900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3dae9f3b-c153-59ec-9e68-15bc9a2c3f90", "id": "CVE-2026-65901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9470d2e4-f240-5564-9ad1-5d0d719f5aaa", "id": "CVE-2026-65902", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0e087b83-53d1-5096-95bb-ac6f97422649", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.1 of DOMPurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:040bef8b-fba6-57f4-84ed-d4614edf3882", "id": "CVE-2026-65912", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3a3c1f71-a238-54e5-861b-80681c7941d0", "id": "CVE-2026-65913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4edf91d6-0bf3-536a-82ab-2e1a86d7b697", "id": "CVE-2026-65914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f98622d2-01be-528a-b89f-5ce52f8b311b", "id": "CVE-2026-66010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:797a1805-6312-5572-a106-317c98ed393b", "id": "CVE-2026-75838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ee139278-9ffa-53b1-9764-7167f60329f3", "id": "GHSA-2cf5-4w76-r9qv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2cf5-4w76-r9qv is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f2ec2ccd-a603-52b1-af9b-cfa024fa33f7", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0052568f-94d7-591e-b83c-dd4178f28f97", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:029cccd0-b4c1-54c7-815c-d120dd4c3c96", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-76mc-f452-cxcm affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f0d8cfbb-44b6-56c7-a556-924e86720471", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dc612f4a-21a9-5d13-93ad-e1917a57d35a", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:881e5339-5ca7-5527-9b35-5d863eaaf5d2", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:68adfbf5-4005-5395-936a-53e3fb43fd7b", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ee2ea17c-4586-5719-8e80-77b881cd79f5", "id": "GHSA-g9r4-xpmj-mj65", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-g9r4-xpmj-mj65 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c2b13b5a-f411-5b2d-bdf3-318f6f992063", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a21f40b9-11fc-5edf-b08a-852e242710cf", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fb1100f5-61a8-58d9-8db6-636a4bf9ac77", "id": "GHSA-q2c6-c6pm-g3gh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q2c6-c6pm-g3gh is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b2690a45-4840-5a22-a2b6-0a6156e4b8d6", "id": "GHSA-q42p-pg8m-cqh6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q42p-pg8m-cqh6 is fixed in version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6f5b1a7e-107f-529a-bc45-06f6a19bed8a", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2772ac16-0336-59d7-bbf8-de21b2bcd394", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 affects version 3.0.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.1" } ] }