{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0f4ae867-1360-50cb-a1dd-f49342e69038", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.3-tuxcare.9", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.3-tuxcare.9", "version": "3.0.3-tuxcare.9", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.3", "type": "library", "version": "3.0.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:2e7e6049-b381-512a-85c5-1d8c4e3e5790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:792a12d2-f810-58fe-9a02-e0edea5d0934", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:4c2d04e8-71e7-5933-80c8-8833d8beab8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:6e79e3f0-0fec-537c-96b9-36ef5f8c7f83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:9b4b3939-4d94-5ed0-8eb5-d2a92bd289c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:473c3393-58e6-5354-9802-9eaf78a91602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:e1a943b5-68d2-50e7-a557-d469146e38d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:ce4bb4d0-65a2-563c-b24f-f107afce1231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:e3015d52-e2ac-588d-9af6-554add551bcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:b024c659-a0ff-5269-9312-65aa13f2be56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:b9cca2f0-5ba4-5346-8492-53ee279a4157", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:860a6ba5-511f-531c-a16d-8ee1d798fe49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:d02987b2-24fc-595b-8299-c6ceec0ba6df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:e877df2c-13ee-52f9-816f-9dd9446962d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:92c44ecb-cfab-5a8e-8f88-a25f9fcb0319", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:a351a382-ba33-52e3-8952-9b4ecb665479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:a5f66564-b4e8-5963-9392-99b14a05a742", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:d2a00e52-062b-5dd1-b302-8be99340aa30", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.3-tuxcare.9 of dompurify. not_affected \u2014 Target version 3.0.3-tuxcare.3 is not affected by CVE-2026-65903. The vulnerable code pattern described in the CVE (single-line condition with short-circuit evaluation bypassing FORBID_TAGS) does not exist in this version. The target uses a nested conditional structure that explicitly checks !FORBID_TAGS[tagName] before allowing custom element tagNameCheck evaluation, which is the exact mitigat..." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:f2afa15c-95dc-5846-be2c-66f428030ec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:c4bd6433-f0f4-5b05-a628-7772074b7ae2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:9943969c-b470-5c19-b7ce-12a0215ca64f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:0a1b6e5c-f4d5-5590-915a-437a027bdb91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:c40ab992-0e04-5fe1-b544-29ddf73ab79b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:817a0039-3ea7-5227-9921-385e2982e8e8", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:3e06e4f7-aa1b-5521-b942-5a3a1fd41f5f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:6574fea0-8a31-583e-9261-e0896b8ffd66", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:8e885c48-9769-55b7-9065-8b45763bda07", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:96f09a4b-4be0-582f-be49-89d5f2e0e9a6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:76dd9b12-7947-540a-a4ea-20cd5f9f164f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:ac0bbab0-3c31-52ce-abb0-e448b509e141", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:6457d4bb-8d25-5ee0-aff7-5e30d0f38c26", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:c51deef7-fae6-5004-9ed8-74c6bfca37a9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:0eaa759b-9572-58ed-8a5a-dab927b029ac", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:b2aa5bf2-8d05-589c-9530-4407af002de0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:966e55e6-4304-55ee-95eb-f001e039c9ad", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.3-tuxcare.9." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:1e3ea462-007f-5898-85c7-503d6ffbdd03", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:ff3967ff-79d5-54e6-b211-eeee29ed521f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.0.3-tuxcare.9 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ], "bom-ref": "urn:uuid:88070608-4c14-5d44-bcb2-87aa6fba61c8", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.0.3-tuxcare.9 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.3-tuxcare.9" } ] }