{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:18fc0b71-c60a-5712-ab24-6706ba05ccb3", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5", "type": "library", "name": "DOMPurify", "version": "3.0.3-tuxcare.5", "purl": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:0dfeca36-0a00-5a5c-8e25-9d020415c24c", "id": "CVE-2015-8861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-8861 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f877cc21-32c5-5362-b2cc-ac7df2f6bca9", "id": "CVE-2019-19919", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-19919 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:462a6032-04b9-5c1c-b727-67046849a538", "id": "CVE-2019-20920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-20920 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:be5cb85e-8a25-58d9-979d-d805e912e34d", "id": "CVE-2021-23369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23369 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0de5b8a8-6370-5f0d-8f41-cd9e5e269846", "id": "CVE-2021-23383", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23383 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:74a42848-0efd-501f-8627-08ab753929e0", "id": "CVE-2022-21704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-21704 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6b4159b1-de89-550b-9940-df00a4b1a675", "id": "CVE-2024-45801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7f1590d9-2225-50b6-987f-17c7b98f7c62", "id": "CVE-2024-47875", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9fc68082-fe56-5924-976d-bd882cf38194", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:327759dd-2dac-5850-8495-83ff8c82d762", "id": "CVE-2025-32996", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32996 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b9ad852d-68f2-512a-971f-9f6b2a05c0e7", "id": "CVE-2025-32997", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-32997 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9b99cebe-33ea-5c38-bd50-065feac21145", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a6def2e6-cb51-5213-a2fc-970ba2d26d6d", "id": "CVE-2026-13676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-13676 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e3c349df-0452-5159-9a8a-6138f925ffc7", "id": "CVE-2026-16221", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-16221 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:39103e7b-e7c6-5584-a2f0-e70cb2d6e578", "id": "CVE-2026-33940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33940 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:77c176d3-85e8-5e10-9a90-56939a629420", "id": "CVE-2026-33941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-33941 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ef2608d5-1ae2-56ef-ae5d-d12f02a70e63", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c8a0345f-b1bf-5a36-b218-f72245c6e264", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d5ec0176-55c0-5faf-a70f-c08d9567b979", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3709913c-43b1-529f-bed8-c83272e159eb", "id": "CVE-2026-49458", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:aa20ade1-8c08-5534-97d5-f062726f968e", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3d21a778-5b51-5581-8f7b-76e4b8b25579", "id": "CVE-2026-49978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e3ee3a64-f5e5-553b-a744-52d80937fbf2", "id": "CVE-2026-55602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55602 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:697d77b0-5724-57db-aa8b-da1cb411c303", "id": "CVE-2026-6321", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6321 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b375ad16-ead8-57e5-83d1-5ec5dcbf9932", "id": "CVE-2026-6322", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6322 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2c17b957-e877-50f3-bdde-5675a3519531", "id": "CVE-2026-65898", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1d02ac28-248a-5d78-b7b8-e59fc7e7124c", "id": "CVE-2026-65899", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6f378af9-75d1-5114-83c2-02e50482bfd8", "id": "CVE-2026-65900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9395e75f-4f54-52d0-9206-e549dfdc988c", "id": "CVE-2026-65901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8ae6f190-763c-56b0-b29f-dc9fd0167126", "id": "CVE-2026-65902", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0d05036c-0f04-5ce7-90d1-13cb2d608ee4", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.5 of DOMPurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:377aecbf-8d63-53ef-ace9-d583bb587df9", "id": "CVE-2026-65912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:07b7cb1b-5f5c-5471-978b-75e9489fa385", "id": "CVE-2026-65913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:24362994-c4b8-5f0f-9947-f11b3c1e6da7", "id": "CVE-2026-65914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7bc5ebe5-358f-5357-9bbb-4e137fd77c5f", "id": "CVE-2026-66010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e94be7af-12b0-53e2-9d91-3d528bb534a9", "id": "CVE-2026-75838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:89b392cb-347d-5f60-a4ea-c49bd056d95a", "id": "GHSA-2cf5-4w76-r9qv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2cf5-4w76-r9qv is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a15416b8-a33f-5e73-9c1c-28c48ac383ce", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1c0c5b04-08d3-5aa0-9d91-88a5f366d173", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e2c42ac2-699e-56ac-b9ab-6468248a080f", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0725d524-367f-5139-8f37-ea789e176130", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f6b1f769-665e-5b62-ba8d-986a2ccbc783", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ad7f3fe0-11e0-58e2-b11b-ac5d801e98a3", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9369701e-bef0-54ae-a1bb-97c3f8a20569", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5113627f-e455-5206-a624-e2826e80aeb9", "id": "GHSA-g9r4-xpmj-mj65", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-g9r4-xpmj-mj65 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a180ed3b-bda9-5c28-8ee6-846a2db5c1cc", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d74c62e6-1859-5a99-bfba-dc9661aff47e", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2a69379e-7094-52e5-bc3f-ecaedff51c2a", "id": "GHSA-q2c6-c6pm-g3gh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q2c6-c6pm-g3gh is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:62308ec6-c9d1-55bb-8c83-531cbb4ab044", "id": "GHSA-q42p-pg8m-cqh6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q42p-pg8m-cqh6 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cad889af-56e3-5a26-bf83-d9e6c5bd64bc", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f8bda7b5-8a09-514a-9a4f-49bcbe2556e6", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.0.3-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:npm/DOMPurify@3.0.3-tuxcare.5" } ] }