{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:20b5619b-3070-571b-a423-efa080ddc359", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/dompurify@2.3.3-tuxcare.5", "version": "2.3.3-tuxcare.5", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3", "type": "library", "version": "2.3.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:4460d82e-cc2a-53e5-816c-d856b12a7ab6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:e1d3240b-eec4-5fb7-b0dd-23659d85b695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:a131552b-81bb-59a8-93bf-652811108fa7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-48910 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:0d223301-0d8e-5f3a-8877-1b375e880ea4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:60d9933d-2e87-5989-a973-db4b7608d682", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:26091a07-492f-58f1-a9bb-a579db76a645", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:2e864e76-e363-5eca-b12a-9547e941ac36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:2d73bd40-a58f-54f2-968b-24b114c41ab5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:6758b5ea-7af7-59ae-8d27-c995c794c90b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:8129fd01-5cef-5e86-9ffc-d836fb47db04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:5bf405c5-b96e-5e56-a03b-8e6fdcb04a48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:f70ac3e1-8a3f-53f5-b1c1-7d0bece673c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:0ea790ee-6bb9-5899-a74d-be68f381f328", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:1e3ce79c-3353-5bfe-933b-bafecbc863d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:1f7d57d2-bf87-589c-977c-a67c26e36326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:eec28aa4-deb6-5fc8-9a15-9a8ea2a2dbc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65903 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:4c426022-17e6-5627-9b9e-6d25b3ccf7e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:58bd8d38-3f60-5021-b2ea-7c9797d92489", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:04b93481-a740-5d25-ab87-7a636c770c7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:7cf87577-eb95-577b-a3c0-120aaad52361", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-66010 does not affect version 2.3.3-tuxcare.5 of dompurify. not_affected \u2014 Version 2.3.3 is not affected by CVE-2026-66010. The vulnerability requires the CUSTOM_ELEMENT_HANDLING configuration feature, which was introduced in version 2.3.4. Version 2.3.3 predates this feature and therefore cannot process the attack input (HTML with custom elements when CUSTOM_ELEMENT_HANDLING is enabled). The vulnerable code path that allows custom elements to bypass afterSanitizeElem...", "justification": "code_not_present" } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:d09d4ddd-cbdf-5d7f-a098-56806f004f9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:93707ad7-1cd4-59b0-a944-fed546f0a3bc", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:85cbd850-60ae-583f-a0c4-08fdd84c7119", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:323eb998-c766-5c93-a2ea-7146f02cca3e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 2.3.3-tuxcare.5 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:2faa3308-d255-54a4-b4dc-17b16964f9d0", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 2.3.3-tuxcare.5." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ], "bom-ref": "urn:uuid:3d280815-66ed-5c09-9bc1-c7294018c0c6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 2.3.3-tuxcare.5 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.5" } ] }