{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:06ffaf81-f2b1-5167-8071-25c8702f1712", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3", "type": "library", "name": "DOMPurify", "version": "3.0.3-tuxcare.3", "purl": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6ae72bc4-aba2-5d29-bd6e-c40ab8f422f1", "id": "CVE-2015-8861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-8861 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c7aa9002-eedd-56f3-bb84-0ff6ead778a1", "id": "CVE-2019-19919", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-19919 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1f61d34d-8483-547a-b1e4-9f63bda766b4", "id": "CVE-2019-20920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-20920 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5a8d2e00-0db1-5528-b36c-a69c49d3f875", "id": "CVE-2021-23369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23369 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a52196e9-21ff-53e1-8c23-58ea43ad1021", "id": "CVE-2021-23383", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23383 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8c0fe512-d553-5bca-9abc-d46184846ac2", "id": "CVE-2022-21704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-21704 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a6a66ae2-cf37-543b-9d7c-6faf6297e8d6", "id": "CVE-2024-45801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e90e452f-2764-5825-b97a-17435d85e234", "id": "CVE-2024-47875", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5f957a51-8b0e-5a6a-9bc8-ed7d89bd452b", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3bbb93a4-7f94-567c-a9ee-af9b73b40b83", "id": "CVE-2025-32996", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32996 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:995f4e71-ad9b-5e53-a6f1-b1a9605fc2b5", "id": "CVE-2025-32997", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32997 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3d8eb633-512d-5657-a715-657722a0225e", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8344529c-78d9-506b-834f-21eae032f9f9", "id": "CVE-2026-13676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-13676 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0e1d89c9-72b0-548f-a434-15b349038c62", "id": "CVE-2026-16221", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-16221 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7ed7e47d-1287-5063-9380-4ff50decdd44", "id": "CVE-2026-33940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33940 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:95f96e59-69dd-54d2-992a-aa16c95965b4", "id": "CVE-2026-33941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33941 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0854e88d-73db-5668-921f-fa5422efc900", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8a2dac1d-646c-5058-a74a-b09efff5ef7b", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8ff8c3a1-c5e7-5608-b904-3a79d6e85bc8", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1d43ee0c-ca5e-585b-ba60-b1e23b70612b", "id": "CVE-2026-49458", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5277d1ad-8667-5ca0-9b68-968e9e959c8b", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ce9aa3e1-2609-5b6b-9df4-cbbc6ab64d50", "id": "CVE-2026-49978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e9395b7c-77f6-5fd4-b553-eb2cf9c6ce9e", "id": "CVE-2026-55602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55602 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:3f0dd7c6-eb29-5c62-8f2c-3b0aa450a858", "id": "CVE-2026-6321", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6321 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:12cf100c-de06-58ed-9898-a04e5b3b24df", "id": "CVE-2026-6322", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6322 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:28e4060a-1099-57eb-a53f-3c9e14d8e161", "id": "CVE-2026-65898", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c45c6453-901e-5eb8-94fb-4a09919e2b34", "id": "CVE-2026-65899", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e9b73a02-cd78-5dee-af8e-48813038823e", "id": "CVE-2026-65900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0d81a2e1-99dd-5ea2-8a7c-0b92642a5b41", "id": "CVE-2026-65901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0d762abd-37d0-56a9-af97-a91f10babf49", "id": "CVE-2026-65902", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4f45582d-6060-59ce-a624-d9250676e7de", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.3 of DOMPurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1258dd35-e273-5649-8956-6f45bcb92887", "id": "CVE-2026-65912", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65912 affects version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:deda18a0-5bad-5cbb-a79f-18608e81a825", "id": "CVE-2026-65913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d46a5cd8-bfc1-58c2-8e60-ecab96929f52", "id": "CVE-2026-65914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:adfb93f3-985b-5183-bcbf-9c4dd75c423d", "id": "CVE-2026-66010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:65f946be-f457-5730-8663-514bf2fefdd9", "id": "CVE-2026-75838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:abdf7c23-1223-5c77-bdbc-ceaf7166dc18", "id": "GHSA-2cf5-4w76-r9qv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2cf5-4w76-r9qv is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:91a49c4b-4eee-5dae-8239-581244786bdf", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0b31c750-76c7-58e3-9303-634782bc401d", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e92aa3b5-e1c4-5569-ac25-c29a0066540e", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8e042f03-c6eb-52aa-8dbb-3c69abd58a11", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:600674d5-25ef-5e46-85bf-42d8436cd4d1", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bc15081b-ffe2-5c8a-adf4-356f07f430b3", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9d03534c-9aa3-56f4-9dfb-d802dd4438c5", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fb8afc5a-636d-507e-8c8d-34ada4e991f2", "id": "GHSA-g9r4-xpmj-mj65", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-g9r4-xpmj-mj65 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ed42aa59-eee4-52aa-b779-c3ffe249b54e", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:761963b9-b8b2-5134-a370-0cee3c1500df", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:55bc5301-f2c6-5b57-ac54-a25365411e4c", "id": "GHSA-q2c6-c6pm-g3gh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q2c6-c6pm-g3gh is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a80e300d-21f7-5a00-b503-def8c77dfb21", "id": "GHSA-q42p-pg8m-cqh6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q42p-pg8m-cqh6 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c2bb236c-91af-5e60-85ea-1a3e2f190b13", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b3ffb1a3-155a-5d1b-a58e-986749b2dbcd", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.0.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.3" } ] }