{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2b8710e3-3a7b-57b8-9a07-209ccde51f47", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3", "type": "library", "name": "DOMPurify", "version": "3.2.3-tuxcare.3", "purl": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:ea09144b-ca15-5a29-8baa-367b45e7a390", "id": "CVE-2025-15599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4ca01fbb-255d-5072-9a0f-557cd35e7d54", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8e8af040-0f2d-515b-9eaa-1ecb651ae9da", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:96423045-1485-5ffc-aad7-2e3864f591e5", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e44a31c8-3371-5d47-9956-d9d1172b0a5e", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1fdf5fdc-3a85-5640-be33-f7a8c32fcb8f", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f04f7549-bf91-59ec-b565-ede8258222ed", "id": "CVE-2026-49458", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5a8078ad-9f53-51e1-8627-f4dbad774ef2", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7cce1bc0-b255-52e7-bef5-d49935fd7925", "id": "CVE-2026-49978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:25bd4df2-2b8e-5a8d-920d-28cc1750d1dd", "id": "CVE-2026-65898", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e47d3329-68c5-5780-b176-7aafd00e2182", "id": "CVE-2026-65899", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2dd95c80-2c29-553f-84c5-6d4c5f09fd4d", "id": "CVE-2026-65900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c4a06a7d-05ed-5c59-a588-c4cd1831df34", "id": "CVE-2026-65901", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e39f3fda-fe54-5878-9918-5afc59a63416", "id": "CVE-2026-65902", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cfa5286e-968a-5680-9785-a335657594d9", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3-tuxcare.3 of DOMPurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b2256719-5eda-5fe4-a495-375e16b761b1", "id": "CVE-2026-65912", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3-tuxcare.3 of DOMPurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:17cbadcd-2504-5964-bb04-b3f1beee760a", "id": "CVE-2026-65913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5dbe5f68-c74b-5112-ac86-c7c9c4355800", "id": "CVE-2026-65914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5c423ba4-5817-563b-8d69-42d180a49f91", "id": "CVE-2026-66010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5dfe542a-67dc-5e2b-8603-4cabbf8ebf87", "id": "CVE-2026-75838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9f9dacbc-f21e-5b82-82a5-d6185443f883", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:aec6f89a-1901-5a23-abe8-814a55e6ea2e", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1f3e40e7-f4f7-54ca-bda3-cf4307a75f2a", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7cf86f60-14d5-5ef0-9f6a-36fda7d4e2d0", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f5b09ccb-a9e5-5599-a88c-8156903893a7", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:eeba7f0c-225e-534d-aa8b-ba0143505e2f", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:785d4fe7-1e75-5efc-9680-dc1e1b30e7b1", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5298f4c3-ce3a-52fa-a1c3-95270f8b43b9", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:01779228-6ef9-5196-b63f-8c0f5545b37f", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:097c1eff-4c26-5967-bea9-4306eec499c0", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8f51ff5e-5eeb-5e5b-89c7-6d6e122a8750", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.2.3-tuxcare.3 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.3" } ] }