{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dc989a1f-dd6a-5595-a692-3bb444cea73d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4", "type": "library", "name": "DOMPurify", "version": "3.2.3-tuxcare.4", "purl": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:11514454-deaf-55b6-9dd6-ee1b452a9f15", "id": "CVE-2025-15599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ebc5d461-1845-5987-bea0-a93eaf07ba3e", "id": "CVE-2025-26791", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d5146c38-24dd-56dc-8c80-b5d2b7c962ef", "id": "CVE-2026-0540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b4a4112b-4318-565b-b8f8-0781dd0d7252", "id": "CVE-2026-41238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9ffd3fc6-7518-5396-a89f-e46ab358969a", "id": "CVE-2026-41239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4049068e-ce43-5c48-82c3-38cdee30c3be", "id": "CVE-2026-41240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f1649fa2-49e7-5e80-9082-0bdbd9853419", "id": "CVE-2026-49458", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:362ae70b-eb61-53af-ac55-7a19e769f623", "id": "CVE-2026-49459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b724fb6c-86e1-5bd2-aa27-2de1fe578b71", "id": "CVE-2026-49978", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:05026566-40b3-51a0-82a1-b63a5073ce1c", "id": "CVE-2026-65898", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:99ae56ea-7661-5c62-a494-5edf13e8c70b", "id": "CVE-2026-65899", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2aed6b24-ab9b-521d-9a9a-a46f32a08b57", "id": "CVE-2026-65900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:61ecc218-681c-5c5a-84c7-443b1babb551", "id": "CVE-2026-65901", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8454c88c-14cf-5118-a282-a95d046e028d", "id": "CVE-2026-65902", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3e421568-03e4-5d6f-9175-cb58743bba30", "id": "CVE-2026-65903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3-tuxcare.4 of DOMPurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short..." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:44f158c9-aad4-5386-bad1-2b5ed452ad0a", "id": "CVE-2026-65912", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3-tuxcare.4 of DOMPurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4eb473ec-370b-5d0a-9ea7-ab39d41899fc", "id": "CVE-2026-65913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:67e899c5-3fd3-5c70-bd7c-def5bed56e52", "id": "CVE-2026-65914", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b55413d2-03e8-5363-8b0b-70093cf321e4", "id": "CVE-2026-66010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:be8fb873-1592-579f-9b43-1c4c1aa814b3", "id": "CVE-2026-75838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6850337f-c7af-5420-9c5d-6d744d052dde", "id": "GHSA-39q2-94rc-95cp", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:17d1f390-ffa4-5c64-8bf9-81f18eccb7ae", "id": "GHSA-55q2-fjhq-7xh7", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5d948d2a-75dd-5795-aa99-a54603c02c10", "id": "GHSA-76mc-f452-cxcm", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2676c80d-4b41-5916-915a-dd133c19b905", "id": "GHSA-c2j3-45gr-mqc4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0484cd05-a18d-59d6-a3d5-7d4c3c8c3558", "id": "GHSA-cj63-jhhr-wcxv", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ce5860b1-ee23-5325-a2ad-4bf2c4495899", "id": "GHSA-cjmm-f4jc-qw8r", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:74c9ecc3-7df9-58d0-87ea-5c605bf1201d", "id": "GHSA-cmwh-pvxp-8882", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:068e0aea-0aa4-5f84-a1e5-dfeaf1158148", "id": "GHSA-gvmj-g25r-r7wr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e84fa280-48c8-5a8e-a94f-6c5b164e164f", "id": "GHSA-h8r8-wccr-v5f2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d4a09147-3451-57a5-a078-2049e844fcc4", "id": "GHSA-vxr8-fq34-vvx9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bfc430c0-7259-51cb-a3f8-3d23d488197c", "id": "GHSA-x4vx-rjvf-j5p4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.2.3-tuxcare.4 of DOMPurify." }, "affects": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:npm/DOMPurify@3.2.3-tuxcare.4" } ] }