{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2b363465-6099-5f7c-9a2b-a843957dcc5f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4", "type": "library", "name": "DOMPurify", "version": "3.0.3-tuxcare.4", "purl": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:396f7d80-b8b1-539c-a33a-c4dbc59abacb", "id": "CVE-2015-8861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-8861 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7ad9bfcf-95e6-58c4-96d0-56092c11ed88", "id": "CVE-2019-19919", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-19919 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ae0dac21-259d-5758-98a7-79b22d4084ef", "id": "CVE-2019-20920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-20920 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:29fa67c4-de7e-5f42-9c71-5a2eb38fb96d", "id": "CVE-2021-23369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23369 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:635392af-4256-5eda-980d-141404df399c", "id": "CVE-2021-23383", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23383 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:99086c6b-5b62-5d5f-9e86-23fee46dfc0d", "id": "CVE-2022-21704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-21704 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2863d98c-5b4c-5a99-92e2-87c035701d85", "id": "CVE-2024-45801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:44c92350-4132-59bf-aef1-9bc8490056fe", "id": "CVE-2024-47875", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a5a0ff0a-df0a-5966-9a17-eed92767556b", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:417ae9db-2a18-5aff-8e4e-aabb08845445", "id": "CVE-2025-32996", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32996 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:aea6bd5e-20e6-5913-813f-0e8c937090de", "id": "CVE-2025-32997", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32997 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1612a499-8ba4-5f7d-a70e-f0748b82252d", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fe60c9be-6b3c-580a-b3ae-2ee282f2b9d0", "id": "CVE-2026-13676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-13676 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2df8e550-2ed9-5716-bf02-9c01099aaef6", "id": "CVE-2026-16221", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-16221 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ac10992a-45d2-5f94-bae9-5507324cd9fe", "id": "CVE-2026-33940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33940 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7e0ab1fb-0594-5d47-a60f-b6a3f259226a", "id": "CVE-2026-33941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33941 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3cf0307b-9a7a-57fd-b7ee-d202c0950e7b", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:09c780d7-6d21-50e5-801c-b4e6324ae7ed", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:084a43e6-15db-5804-a52f-4487b2bee57d", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5dc609a8-7eab-5771-a8b9-f7f56555715c", "id": "CVE-2026-49458", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b654f935-c34d-592d-bd28-43090b70300f", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:180f975d-acf9-5047-87d0-0863c1086644", "id": "CVE-2026-49978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:814ea321-1d93-598d-a6d8-ea3398aa34f2", "id": "CVE-2026-55602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55602 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:12bd945d-18e9-5d07-b0ef-b2027d5c22c6", "id": "CVE-2026-6321", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6321 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ac29623a-d90c-59b3-b161-426727b61e9f", "id": "CVE-2026-6322", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6322 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c22bbdcd-457f-5fdd-b337-95559d43b659", "id": "CVE-2026-65898", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4e611501-ed0b-5a41-a181-864f8ff8f406", "id": "CVE-2026-65899", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8d5be58f-1ae4-5773-a2f0-4e34a8af5102", "id": "CVE-2026-65900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4d27d2dd-c5b4-5404-bfba-71853eb8bd38", "id": "CVE-2026-65901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:26322580-93a0-5819-bdf5-991f75ac1211", "id": "CVE-2026-65902", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ec6a33d4-2317-5288-a4c3-7c0f8439781a", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.4 of DOMPurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:be9ca56f-a842-5aee-b82b-9e218e275fc3", "id": "CVE-2026-65912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1454557c-5be7-55b9-b7a3-df70f88f55d9", "id": "CVE-2026-65913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:789901c4-0933-5a3b-9e8e-e77ea5151254", "id": "CVE-2026-65914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:035b164d-0078-5e75-9d73-e22cc3dd48a3", "id": "CVE-2026-66010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:105960a0-fa10-573e-876c-53bfdb7c8e81", "id": "CVE-2026-75838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:46039d0a-7028-5dcb-82dd-e4a651faf10b", "id": "GHSA-2cf5-4w76-r9qv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2cf5-4w76-r9qv is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9af3c5d1-c8e7-51f4-963c-2196ce065b3f", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8acc8fdc-af15-5389-b7fd-53395d2a267c", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:efc4636e-5621-5fc8-b601-262d8e82c681", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:df7da11d-fefe-530b-9059-96c84d3b93c1", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:51004ad1-14de-588b-a00e-2c0d26aafc69", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:45fde281-99e9-57c3-ab99-1d600fb3ac6a", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ab1555a3-2dbd-52cf-826e-feb29a017c10", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:162c427e-9946-5849-81e7-701a27266ebc", "id": "GHSA-g9r4-xpmj-mj65", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-g9r4-xpmj-mj65 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d9a53056-460f-5f3b-b7a0-2ae625f4d8be", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2450410b-eeab-585d-b685-bd56b899fdaa", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a7b79d70-48b1-577d-b451-ad5d0d0c4a92", "id": "GHSA-q2c6-c6pm-g3gh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q2c6-c6pm-g3gh is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6effa3ee-48a0-5bf6-8694-80cc988f1085", "id": "GHSA-q42p-pg8m-cqh6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q42p-pg8m-cqh6 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:aa212e32-d3f5-5877-a71a-15b1486d82e1", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:781e6868-988d-5c3b-876a-02f04e0f6f74", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.0.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.4" } ] }