{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:04323704-465e-504c-9aea-6787a86ceeb2", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5", "type": "library", "name": "DOMPurify", "version": "3.1.6-tuxcare.5", "purl": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:73337c45-c3cf-5e20-ac28-9f6de477401d", "id": "CVE-2025-15599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a9ad974b-c021-550d-9a6e-4bf82a7d3106", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:55f913c6-b9f3-5d4b-b4ac-5a863e7fd95f", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:32a4b25b-4a1f-5c02-82d4-23cdacc8e0b1", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:44e025ba-1394-57f4-851d-b6507f143a77", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:707e726a-78f3-58f2-8665-abb47b2e1bcd", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8c36244a-62a7-50ec-9baf-969487dabe11", "id": "CVE-2026-49458", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3c410de6-1c33-50be-8d5d-2c2a3322315e", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:43014aec-a6e5-56e6-8e0d-9812cf3b5dfd", "id": "CVE-2026-49978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9dfdf845-a9f9-5fbd-b243-f460dfbc2ad3", "id": "CVE-2026-65898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d4b03061-7781-520a-aa7d-a29306fd6181", "id": "CVE-2026-65899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ce9fa208-15d0-5e42-98b2-080627498d4a", "id": "CVE-2026-65900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:07e7b2a6-acd6-5fec-b6e0-2bd304d83aed", "id": "CVE-2026-65901", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65901 does not affect version 3.1.6-tuxcare.5 of DOMPurify. not_affected \u2014 Version 3.1.6 is not affected by CVE-2026-65901. The target contains a defensive mechanism that uses a realm-safe cached prototype getter (getNodeName) to validate element types, which bypasses attacker-controlled own properties set via Object.defineProperty. The CVE explicitly targets version 3.4.6, which is newer than the target version 3.1.6." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:873ba584-1c34-5e88-afdd-fb82bc5a7bc5", "id": "CVE-2026-65902", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:25fc7e5b-8929-5213-a0ca-05a7d6e304c8", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.1.6-tuxcare.5 of DOMPurify. not_affected \u2014 Target version 3.1.6-tuxcare.5 does not contain the vulnerable code pattern described in CVE-2026-65903. The CVE describes a short-circuit evaluation issue in v3.3.3 where ADD_TAGS as a function (via EXTRA_ELEMENT_HANDLING.tagCheck) can bypass FORBID_TAGS. In v3.1.6, the equivalent logic (CUSTOM_ELEMENT_HANDLING.tagNameCheck) includes an explicit guard at line 1538 that checks !FORBID_TAGS[tagN..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8517ba63-bf03-5143-824f-f8c0d03548bb", "id": "CVE-2026-65912", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.1.6-tuxcare.5 of DOMPurify. not_affected \u2014 DOMPurify version 3.1.6 is not affected by CVE-2026-65912. The vulnerability requires predicate-based attribute allowlisting features (ADD_ATTR as a predicate function or EXTRA_ELEMENT_HANDLING.attributeCheck) that do not exist in this version. Version 3.1.6 predates these features entirely." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e764af69-d7ef-5ec2-9ea8-fedabece2b3f", "id": "CVE-2026-65913", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:63d4c9a2-863c-5bd6-9c9c-0ae61583e50c", "id": "CVE-2026-65914", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65914 does not affect version 3.1.6-tuxcare.5 of DOMPurify. not_affected \u2014 DOMPurify 3.1.6-tuxcare.5 is not affected by CVE-2026-65914. The target version contains a runtime defense mechanism (SAFE_FOR_XML, enabled by default) that removes attributes containing closing tags for special parsing-context elements (xmp, script, iframe, noembed, noframes, noscript). This defense prevents the mutation-XSS attack described in the CVE when DOMPurify is used with default confi..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f09123dc-9d0e-55aa-9adc-2d8982d7e6cc", "id": "CVE-2026-66010", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b395317e-fcb2-5947-840d-c63d88fbc052", "id": "CVE-2026-75838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0645e3ab-4f1c-54d0-9879-078b9bbd8fb5", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e0b69403-b953-5db8-9e53-818611047641", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:12726650-e2d5-59f3-ad5c-02a4b8bf286c", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:24845911-69eb-5af9-821a-d8cf8f657b5d", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:089dce03-67e2-5c75-9e13-eb32b0b06153", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b208a35a-d579-56a9-8548-141ec42d2f72", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:917c6113-da29-5486-87fb-7a769853e05f", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9ec5d1c7-f99c-569e-9079-cfcdef47c5be", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6d142deb-b2a5-5b95-bf16-d385bab06445", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fdb4b220-e334-5ade-a37f-1a1220c948d1", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:68457c05-fb28-5a0a-944c-a2b37fa8c57a", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.1.6-tuxcare.5 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:npm/DOMPurify@3.1.6-tuxcare.5" } ] }