{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4436f445-b2a7-5c70-9ca7-036798750fb4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.0.8-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/dompurify@2.0.8-tuxcare.7", "version": "2.0.8-tuxcare.7", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.0.8", "type": "library", "version": "2.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:80a3e2e9-6765-5e91-a296-90a30701bc07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-26870 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:383f2926-fd9f-558d-aaa9-000b0b4b8e71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:75eb9874-d2a9-51ad-a38e-7736aacaad52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:4812b6f6-a79a-51b1-b6e2-9aeb581d5511", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-48910 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:d949254d-1929-5640-b21c-2b7b060e6912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:e7520035-c2dd-516e-9822-569f4662e4f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:8b832aae-90a0-558d-8195-ac0f75f296fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:5cfc3bce-533a-5a1d-b655-0ef23822a1e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:12df8982-e4df-5b74-844b-98c55983747a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:51ec5ab1-6479-514c-ba14-b065ff8d7c32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:c0254f47-038d-56e2-abbb-595a908e0b08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:1c59875c-e3a4-5e51-88b0-232a58e0804f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:9642dacd-c4b1-5631-a2c5-bbf6a62588d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:a225a52e-f575-5bfd-ab29-3d7ee5a0044e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:987f5c98-035d-52fb-8bb0-a94ee52e386b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:55ae0d5b-74dd-5762-926a-63d8709d44d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:fa192ccd-33a4-56b7-9f37-c396b9c784ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65903 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:9a3c97fe-8826-5b44-ad97-f5fabd7f3a44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:835a7b52-f98c-54c8-a76e-ff042c94ea8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:32e2d95f-9c87-5d5d-8457-524998b20ebb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:1f6ac7ae-6fc7-5dd8-a715-b15b84fed117", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-66010 does not affect version 2.0.8-tuxcare.7 of dompurify. not_affected \u2014 DOMPurify version 2.0.8 is NOT affected by CVE-2026-66010 (GHSA-c2j3-45gr-mqc4). The vulnerability requires the CUSTOM_ELEMENT_HANDLING configuration feature, which does not exist in this version. Version 2.0.8 predates the TypeScript rewrite (uses JavaScript src/purify.js, not src/purify.ts) and the introduction of CUSTOM_ELEMENT_HANDLING. All surviving elements in version 2.0.8 go through the...", "justification": "code_not_present" } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:bf30d804-e4a3-5f73-9fd6-b13289ff39c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:5961825e-0428-5cfb-877b-f18fda5375e5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:e4e597cf-66fb-5ce1-92ef-dbf0041a06bd", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:20553ae7-7d32-59a5-bb10-b14e4ba8a726", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 2.0.8-tuxcare.7 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:ae696b3d-bc01-5e55-8c5e-db39b3e2e0e8", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 2.0.8-tuxcare.7." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ], "bom-ref": "urn:uuid:82b4f756-b8db-556d-90e9-b925398980e9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 2.0.8-tuxcare.7 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@2.0.8-tuxcare.7" } ] }