{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:62357b31-0125-5c4f-ad43-e872fd3396ed", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2", "type": "library", "name": "DOMPurify", "version": "3.0.3-tuxcare.2", "purl": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e1b0261e-a0bb-5774-bc18-cec337ef611e", "id": "CVE-2015-8861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-8861 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bcc9fd63-6ad5-53f7-bdd1-2a9e42cd52fd", "id": "CVE-2019-19919", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-19919 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4aaefa1a-cc94-59d5-b72c-2119c496d0ed", "id": "CVE-2019-20920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-20920 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:db804e54-902b-57b7-b598-451712880917", "id": "CVE-2021-23369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23369 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5e65655c-6592-5942-9cde-cb8412376382", "id": "CVE-2021-23383", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23383 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2635016f-9085-53d1-a976-935703392efe", "id": "CVE-2022-21704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-21704 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1bc8b119-3905-5575-8a41-c3952a6bfbf7", "id": "CVE-2024-45801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:97a566f3-c310-5188-8029-80e282b79bc1", "id": "CVE-2024-47875", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:30529318-d506-5853-b3c4-4ccebdf9cef6", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:27260662-a626-5c67-8ff0-8e512a61b44a", "id": "CVE-2025-32996", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32996 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fedb8661-bf9e-50d5-9c0b-e4ab7f3831cb", "id": "CVE-2025-32997", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32997 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:76cd019f-00f5-52ac-a035-9b1b6baf1076", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ee83a73c-9af9-5995-8d0f-94269cb11086", "id": "CVE-2026-13676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-13676 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ae1c3725-8b8f-5517-b42e-9ed9ac13f074", "id": "CVE-2026-16221", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-16221 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9a93421a-9152-54f1-afac-1a8ae65d2e9c", "id": "CVE-2026-33940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33940 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2295a2ad-8123-5c5d-98c9-87bd807b314c", "id": "CVE-2026-33941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33941 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:58c00413-d8ef-5147-a3cc-c73126b21d69", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:093599fc-dde4-58e2-9aa9-a6a74fb205b4", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ee68e971-4c98-5503-b8b3-c57540c2d795", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8ce5f42c-a29b-5986-ab5c-8dee8015707f", "id": "CVE-2026-49458", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1dd00df6-1fae-5f20-9866-0ccf4d43a44e", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:7e902a16-f563-50a4-835c-a0919c1cc9bc", "id": "CVE-2026-49978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:066877d4-c32b-560a-8e89-735a5265aac2", "id": "CVE-2026-55602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55602 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bb29f518-550f-583e-a948-eca5d06ae899", "id": "CVE-2026-6321", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6321 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3e695a5e-a52f-588c-9f0a-3c52b7d1907f", "id": "CVE-2026-6322", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6322 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b20a0f03-de97-549a-8915-8a50b2898027", "id": "CVE-2026-65898", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d9474b10-5abb-5df3-9578-beac55b51a8c", "id": "CVE-2026-65899", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c9c94277-580f-50e1-abf0-84fce04a07e2", "id": "CVE-2026-65900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:856ddcd2-701c-56e0-b3f5-43fc4c401b98", "id": "CVE-2026-65901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a934ad75-2cd1-5551-939d-9078cae71ee7", "id": "CVE-2026-65902", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:26698336-e76f-5730-acc7-29aadace95d8", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.2 of DOMPurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:86f7d562-c51d-5ee5-a27c-ce9cc828dd92", "id": "CVE-2026-65912", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e4838284-d07e-5c16-bf28-8cb2288492b8", "id": "CVE-2026-65913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ee59bd77-439f-5760-bca6-002c25f410cc", "id": "CVE-2026-65914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4f14ab95-bc33-5c33-ba48-f8a229874d5f", "id": "CVE-2026-66010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f94ca94b-bbf0-59a1-a48b-d8c703d84942", "id": "CVE-2026-75838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:727969ec-efa8-5ea5-a6b9-b28f32eb906b", "id": "GHSA-2cf5-4w76-r9qv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2cf5-4w76-r9qv is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f03eef3c-b41f-571a-9231-047cdec4540a", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2d66bf77-b1f7-56da-96b7-56b179066b06", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1bf0b735-e84e-5ae7-8c21-cdef56cb1138", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f77e1a81-d5f3-5c8f-b8ca-bfd3e35e445d", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 affects version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0d558880-6dd5-5d18-9044-fc787434cfed", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d7e8ed8c-03a7-5e9c-b12d-478b3ca62fb9", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:15ed5472-8a7f-5fc9-8788-2847b897875b", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fc5f7716-8553-5982-ab09-624085e979d6", "id": "GHSA-g9r4-xpmj-mj65", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-g9r4-xpmj-mj65 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b1c36628-7b01-5951-af1b-d0b8576b281d", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9a91d026-a8b5-585c-af1c-b2491fa40f34", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:90c8d059-a149-5874-a689-86597d284753", "id": "GHSA-q2c6-c6pm-g3gh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q2c6-c6pm-g3gh is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:152dc123-a58b-54ba-940b-d338e58f2e33", "id": "GHSA-q42p-pg8m-cqh6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q42p-pg8m-cqh6 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ca5c412a-0874-53c9-a949-96f540fcafa9", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d17c584b-608a-518f-9865-970f26bdf1b8", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.0.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.2" } ] }