{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dd74630a-de60-560d-9ccd-a069d08cb463", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.4-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.4-tuxcare.5", "version": "3.0.4-tuxcare.5", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.4", "type": "library", "version": "3.0.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:fe6fd368-dec2-54d6-8e08-9cd3046650e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:a7cc6eb1-711b-5a61-9427-c0e8ef49189a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:014db125-e929-579b-9cf4-e39725984397", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:8e9bbc56-f496-5bfc-b73b-c6688286a546", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:271df3b7-cbd1-5743-a421-9c9a6f3f3d6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:85c9be35-cb3d-542f-9c14-fed63b3e5339", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:6619d049-361f-5444-98af-9d2ae0ee257f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:242ec3e3-7b73-5418-8534-369ada5b1d6b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.4-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify 3.0.4-tuxcare.1 is NOT AFFECTED by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS configuration (introduced in v3.3.1+ via commit 6c08b7d1) to bypass FORBID_TAGS checks. Version 3.0.4 predates this feature by ~8 minor versions and only supports array-based ADD_TAGS. The vulnerable code path (EXTRA_ELEMENT_HANDLING.tagCheck evaluation) does not exist in this version...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:88f22fd0-1854-5b03-9580-597c8120f310", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:d78d3dda-b4b6-5fd3-a298-3f8a8f26d658", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:93b76372-6049-57a1-b0f5-ededadcaabc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:428057fe-d5f8-5a8d-bdec-7bca0ba51d36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:8b6c12bc-db8e-5de2-9f21-5982b0c15ee7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:d1ad0d63-8d10-5468-b37a-4cf5ec718119", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:cec86c21-91e6-5cf8-b867-0fbf3349185d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:2fa1ea39-feee-5912-b72f-9777cf615e75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:ff89f926-ab2b-5303-9b56-4f5aa4b8bdc1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.4-tuxcare.5 of dompurify. not_affected \u2014 Target version 3.0.4 does not have the short-circuit vulnerability described in CVE-2026-65903. The target uses a different architecture where FORBID_TAGS is explicitly checked via a guard condition (line 1019: `!FORBID_TAGS[tagName]`) before allowing custom handlers to keep elements. The upstream's vulnerable short-circuit pattern does not exist in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:c3948697-ee22-53a2-a58d-05dec3c05f56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.4-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify 3.0.4 is not affected by CVE-2026-65912. The vulnerability requires the ADD_ATTR predicate function feature (EXTRA_ELEMENT_HANDLING.attributeCheck), which was introduced in version 3.3.0 (commit fa239f04, October 2025)\u2014approximately 2 years after version 3.0.4 was released (June 2023). Version 3.0.4 only supports ADD_ATTR as an array of attribute names, not as a predicate function, so...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:3af5b194-c52b-5bf8-8bca-e51f903ba18a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:89e7363f-7434-5028-93ac-55e4461473a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:ce7577eb-02fd-5b34-bd2e-1c88f8c2dfb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:68c31d6d-f330-5742-bc35-48fda3905346", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:85312316-681a-5582-93e8-45bc76930ae1", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:22ed8b4d-480e-5c82-8735-8f04574faaa8", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:fb44b20a-7a4c-5a33-9c51-8923e66c27fc", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.4-tuxcare.5 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:ab45bce1-28e1-5980-bde4-a5fa67f066ab", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.4-tuxcare.5." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ], "bom-ref": "urn:uuid:b0351b4b-7d2e-592d-8e53-fa4c36d98683", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.0.4-tuxcare.5 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.4-tuxcare.5" } ] }