{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c83df82d-57ce-52f1-8866-fe9f95036e1d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4", "type": "library", "name": "DOMPurify", "version": "3.1.6-tuxcare.4", "purl": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:092ec8b6-61d5-59ab-9946-16aaa4971c6a", "id": "CVE-2025-15599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:adee5d71-3105-5ddb-aaec-3b29cbf37dac", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:45aad001-28f1-5362-89f7-892a1df4df39", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:829d07e0-b004-5595-b023-f111130272d3", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6f93ee3f-fcc6-5f57-ae72-e79f1405b4f8", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:274a2485-a2a9-53ca-bfb5-59e88b0c1836", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:89fcb146-7652-5cf9-8b81-d19980254774", "id": "CVE-2026-49458", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0d99518d-bf8d-5c4d-a14a-983157dcd7c8", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ac8e2832-1f5a-5957-9387-e79dfbc116df", "id": "CVE-2026-49978", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b371e72f-d930-5b27-a55a-8da4872650fa", "id": "CVE-2026-65898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e184fc3d-9298-577f-a555-066a02f7d461", "id": "CVE-2026-65899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8caca24f-eba8-5e1a-958b-33e6b57ef9e7", "id": "CVE-2026-65900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f445ebc4-1191-5d74-9885-1b192220ee4a", "id": "CVE-2026-65901", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65901 does not affect version 3.1.6-tuxcare.4 of DOMPurify. not_affected \u2014 Version 3.1.6 is not affected by CVE-2026-65901. The target contains a defensive mechanism that uses a realm-safe cached prototype getter (getNodeName) to validate element types, which bypasses attacker-controlled own properties set via Object.defineProperty. The CVE explicitly targets version 3.4.6, which is newer than the target version 3.1.6." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6185e82b-11c5-5a79-bd86-21990d6654a0", "id": "CVE-2026-65902", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9ee28fc7-1f3d-5414-9912-6f245eaf2ed6", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.1.6-tuxcare.4 of DOMPurify. not_affected \u2014 Target version 3.1.6-tuxcare.5 does not contain the vulnerable code pattern described in CVE-2026-65903. The CVE describes a short-circuit evaluation issue in v3.3.3 where ADD_TAGS as a function (via EXTRA_ELEMENT_HANDLING.tagCheck) can bypass FORBID_TAGS. In v3.1.6, the equivalent logic (CUSTOM_ELEMENT_HANDLING.tagNameCheck) includes an explicit guard at line 1538 that checks !FORBID_TAGS[tagN..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3ffe4cc4-8bc8-584b-ab44-f49ef5ad4118", "id": "CVE-2026-65912", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.1.6-tuxcare.4 of DOMPurify. not_affected \u2014 DOMPurify version 3.1.6 is not affected by CVE-2026-65912. The vulnerability requires predicate-based attribute allowlisting features (ADD_ATTR as a predicate function or EXTRA_ELEMENT_HANDLING.attributeCheck) that do not exist in this version. Version 3.1.6 predates these features entirely." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6a6f3da2-c4b5-544e-b706-e3688094a6c4", "id": "CVE-2026-65913", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e2cfe1b9-9ad1-5cce-bb12-97a78190d72c", "id": "CVE-2026-65914", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65914 does not affect version 3.1.6-tuxcare.4 of DOMPurify. not_affected \u2014 DOMPurify 3.1.6-tuxcare.5 is not affected by CVE-2026-65914. The target version contains a runtime defense mechanism (SAFE_FOR_XML, enabled by default) that removes attributes containing closing tags for special parsing-context elements (xmp, script, iframe, noembed, noframes, noscript). This defense prevents the mutation-XSS attack described in the CVE when DOMPurify is used with default confi..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5df91e86-4d4e-5323-bcc2-4f74eff29474", "id": "CVE-2026-66010", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:aa937dd2-45f6-58dd-9cbf-e770bdef4505", "id": "CVE-2026-75838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:dbd10020-2825-5d20-8b56-79f86049f45f", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:813589ea-65e1-5307-b199-38c70187fea2", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:864332ef-702a-5c30-a86f-47ab05884748", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bbc2f8fe-3d24-5dff-a945-b193d7e95e83", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:24aa743b-975d-5d50-bd90-e81340cf95ae", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1ab73f51-2041-5b1d-b7a8-449584bab79a", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:df7c1770-faf9-5fa2-b1be-0ca946b5711e", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:76ad2287-1f85-518f-bca4-9d07e2558ee4", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2d4da713-7933-5534-ad2d-1c76f598b82b", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b0186e22-7a47-5d2d-9c8d-bd6e3d9d3b97", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d69016b7-39f6-5bd8-827f-80e9a95de7c2", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 affects version 3.1.6-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.4" } ] }