{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c9ce809f-0bda-5438-a767-34205db04a1c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.4-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.4-tuxcare.4", "version": "3.0.4-tuxcare.4", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.4", "type": "library", "version": "3.0.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:0d1597a5-6bd1-5e56-be0c-db94415fb269", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:41d588a5-d2ed-59c5-947a-de36a329f26c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:8bd3c48c-d6aa-5d7a-849d-290d54c4703b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:33404e0a-6d7d-51db-9105-fb77a383334d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:4fcee828-e30f-51d9-a53a-9f700d6134c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:ca19161a-b863-53cb-b00b-1810596c6dfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:4d01c0f0-991b-5c1b-ae7f-0fe2a09be7ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.4-tuxcare.4 of dompurify, and is fixed in 3.0.4-tuxcare.5." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:262c7954-ba9f-581f-8345-f1d70d50dae6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.4-tuxcare.4 of dompurify. not_affected \u2014 DOMPurify 3.0.4-tuxcare.1 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (introduced in v3.3.1+ via commit 6c08b7d1) to bypass FORBID_TAGS checks. Version 3.0.4 predates this feature by ~8 minor versions and only supports array-based ADD_TAGS. The vulnerable code path (EXTRA_ELEMENT_HANDLING.tagCheck evaluation) does not exist in this version...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:61e76cc6-0c35-5aa3-918e-1fc1358e2f08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:9d32e8fe-322c-58a1-9b58-8532c791c369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:7ea31be8-fd23-5e09-a03c-519ed99310db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.4-tuxcare.4 of dompurify, and is fixed in 3.0.4-tuxcare.5." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:ff036322-4a2e-565c-955d-e454c79916fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:3c4952f7-5d2f-5fb3-8e4f-23c93c0f7e15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:615babcd-a787-55d2-b81b-6de8f0dc29f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:391ef66b-9800-5e66-8dd4-ec1169c0eb93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:122e8dcb-dce4-5219-8865-cef821a203ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.4-tuxcare.4 of dompurify, and is fixed in 3.0.4-tuxcare.5." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:15a13d55-97e1-5212-ad1b-e403397a5ea2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.4-tuxcare.4 of dompurify. not_affected \u2014 Target version 3.0.4 does not have the short-circuit vulnerability described in CVE-2026-65903. The target uses a different architecture where FORBID_TAGS is explicitly checked via a guard condition (line 1019: `!FORBID_TAGS[tagName]`) before allowing custom handlers to keep elements. The upstream's vulnerable short-circuit pattern does not exist in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:f5863740-fb57-5b7f-a2c3-a75ebf47a42c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.4-tuxcare.4 of dompurify. not_affected \u2014 DOMPurify 3.0.4 is not affected by CVE-2026-65912. The vulnerability requires the ADD_ATTR predicate function feature (EXTRA_ELEMENT_HANDLING.attributeCheck), which was introduced in version 3.3.0 (commit fa239f04, October 2025)\u2014approximately 2 years after version 3.0.4 was released (June 2023). Version 3.0.4 only supports ADD_ATTR as an array of attribute names, not as a predicate function, so...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:83858c9a-d883-583a-a0f6-f2335f07533e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:9379507a-1cd9-52a7-b87d-117a7ecec378", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:f16bd0f0-43df-558e-aa70-254f52ab7171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:2fef8d1a-9fc1-5f2e-ad39-1f6ce519ee64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:0df63085-fd17-5090-8892-d0e82d151ed3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:5d1dd0bb-adf4-50a6-9336-9548f86f0ca9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:d98aafeb-f5d7-5cdf-9039-913965f3fc5c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.4-tuxcare.4 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:c88fdbb7-89e9-5c1c-be88-9afa9d3ecdfa", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.4-tuxcare.4." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ], "bom-ref": "urn:uuid:ce735229-3e07-5600-aaba-6d05ba46f07e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.0.4-tuxcare.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.4" } ] }