{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cfa4e2f0-8fb9-56a3-bb2c-94783aa89b76", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1", "type": "library", "name": "DOMPurify", "version": "3.2.3-tuxcare.1", "purl": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c90de1bb-9b95-5204-97bd-7517284f69af", "id": "CVE-2025-15599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6b6f653b-7970-5b39-84c6-03fba1569907", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f3256da5-2343-5d51-8b88-702fb682b946", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f4cc42e6-1977-5c04-9e69-85855abc14e7", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:848f5837-4a11-5838-8251-fa2679480f8a", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:60b7e5f7-1526-58cf-9fce-d123878f0e89", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c9be84f9-19ff-5656-a55e-cc3bda22ad9b", "id": "CVE-2026-49458", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:485e9531-c708-5650-ba98-e4da17e30c11", "id": "CVE-2026-49459", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49459 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:442d7152-10d4-5c97-a95d-210a4ebb3561", "id": "CVE-2026-49978", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:68ef0cff-7030-5a85-9290-32e6bd591fa9", "id": "CVE-2026-65898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2ac40b56-f68f-57c0-82d8-2e29ce4b5a8c", "id": "CVE-2026-65899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3d67000a-506f-5896-a6a3-a12512c8cf5c", "id": "CVE-2026-65900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:68427100-9061-53e5-a5ac-1eae1f04d04f", "id": "CVE-2026-65901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:959faa96-1e2a-5b4a-a17e-384014d8c7f0", "id": "CVE-2026-65902", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dc1587a9-5e22-566f-9e71-6c4afa724487", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3-tuxcare.1 of DOMPurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f9137dc4-5581-5a88-829f-f22611caa0e1", "id": "CVE-2026-65912", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3-tuxcare.1 of DOMPurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:76ff89b4-3713-539b-806d-8e408218bf70", "id": "CVE-2026-65913", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1369457-d88e-55cb-94d4-c75d492adce3", "id": "CVE-2026-65914", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0793420e-1113-5c30-a23b-876af63cf3a8", "id": "CVE-2026-66010", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b7b9fa34-9281-5542-a287-08933c506ff8", "id": "CVE-2026-75838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6130343d-4341-5b2d-81fd-f29a8594dda2", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:68342c9b-cbf1-5c0b-956b-384f96898bca", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:63452465-a3e7-532c-bb2c-6042fac5da04", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-76mc-f452-cxcm affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:aa4ee30e-13b0-5497-acae-ce1b855c4a73", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:00b210dd-4601-593c-a583-80164e5bd656", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6ced9d87-30cf-5686-a9af-c10ee5f08791", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:898a0960-3afb-567f-8a20-564466dce5b9", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0a44936f-ee91-559f-82a7-c2011fec406a", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4a23b8b7-313f-5eda-8558-0807d0b945b4", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:171f70f5-1a9c-5168-97de-a7c69747ad59", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9fcb3d6e-386c-5d00-9d56-0aaf29e53343", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 affects version 3.2.3-tuxcare.1 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.1" } ] }