{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:561a3176-c659-5a92-82a1-f50796ba9334", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2", "type": "library", "name": "DOMPurify", "version": "3.2.3-tuxcare.2", "purl": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5bce3a10-6336-5a2f-a57c-a14c41584599", "id": "CVE-2025-15599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c7c6815a-ad87-567d-82dd-3520980a33cd", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6737a100-a68f-5bfd-b0f6-2b03ec258165", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:9b3f8bc1-eb77-5341-8667-555694e17457", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d79445c6-bacf-502c-8893-601e5aece02b", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8cb060c5-27ae-5c03-99cf-64d0f01541de", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b31191ef-074f-548a-969d-69b48f761674", "id": "CVE-2026-49458", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49458 affects version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fc5f24ec-146c-5c90-8015-b36d2d5cd1f9", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a87db0a4-71ef-52a8-a37f-3e6450309751", "id": "CVE-2026-49978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8854857a-f0c0-5378-a1d5-35e06a991ebe", "id": "CVE-2026-65898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65898 affects version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:62fd5bef-a242-567d-8dcf-56149a718122", "id": "CVE-2026-65899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65899 affects version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bb75199e-64b5-59d1-883b-16f3e8bf3375", "id": "CVE-2026-65900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4fc49c81-acd2-58ab-bbb9-566c07fc2915", "id": "CVE-2026-65901", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65901 affects version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4956affa-0cb9-55ce-bdd5-8f154efeb1af", "id": "CVE-2026-65902", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5c765435-3a94-5edd-b04b-9a4b20d8cbd7", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3-tuxcare.2 of DOMPurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c73e24ef-c6ec-565e-9ad3-95e79fd99fb3", "id": "CVE-2026-65912", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3-tuxcare.2 of DOMPurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:dc8c0cc4-99ed-585f-af4a-d84c4b52f288", "id": "CVE-2026-65913", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65913 affects version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ab43328d-48cc-5f83-bc7f-3d5a0341dbd0", "id": "CVE-2026-65914", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65914 affects version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:91c6ece2-c5b0-58fa-b8fa-6989cca5c95f", "id": "CVE-2026-66010", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-66010 affects version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d89fa1ac-d5a5-5383-ae19-568fc2f7d6ba", "id": "CVE-2026-75838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1bf0bfb6-03b3-5a6e-8774-649979827f76", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c5e3c968-ade8-5dad-b554-fdcc367d2d56", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a38b4fa6-d68b-58ee-918d-096e6fee6eab", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f99a852c-fc43-5796-993e-b3e7f928d720", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8ff52f40-3da1-50eb-b477-248a19709c86", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5867044f-59a1-5e36-bede-e31087bd1c6d", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:95f00472-f4b3-58d4-8bbd-0c9dc2ed6402", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:af1f1536-e608-5554-ba72-466f4e9e0967", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a25ea644-53dc-5171-99a6-cda14ab7e424", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d6175e0f-ab80-522d-9b07-2ee1e765c395", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:58ee4d12-d94e-5767-9a51-1c689e3ef6f2", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.2.3-tuxcare.2 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.2" } ] }