{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9ed1d148-443c-5bee-9d6b-cfa38cb4780a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.5-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.5-tuxcare.4", "version": "3.0.5-tuxcare.4", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.5", "type": "library", "version": "3.0.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:6e750613-2700-58fc-9bd8-b594a4be2397", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:da0e0914-d8ad-5c04-b09d-0bbce1c022a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:22e58869-d4a1-5152-b93b-0f03554af57c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:11d0264f-f8ae-5613-bdee-6c5c4907793d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:2b001f50-aff7-5862-9e4d-180667a4e938", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:8d386b89-a207-5482-bfe2-75b8afd2b247", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:af603b0f-ffa2-5a52-b081-8269a13503cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.5-tuxcare.4 of dompurify, and is fixed in 3.0.5-tuxcare.5." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:a712464a-a25b-5ea2-a908-1991cab6e805", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.5-tuxcare.4 of dompurify. not_affected \u2014 CVE-2026-41240 affects DOMPurify versions 3.3.0 and later that support function-based ADD_TAGS configuration. Target version 3.0.5 does not have this feature (introduced in 3.3.0, October 2025). The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck mechanism to bypass FORBID_TAGS checks via short-circuit evaluation - this mechanism is entirely absent from 3.0.5. Version 3.0.5 uses only arr...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:68b5061c-48ed-5c6a-8cd2-3f2bf6b4e915", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:e92435a9-e195-515f-a17d-07d4db0e2ef9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:a9d6bd14-9921-5bd8-8327-bd8474a944ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.5-tuxcare.4 of dompurify, and is fixed in 3.0.5-tuxcare.5." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:b04356ec-e394-55c1-833a-5dc1be1558a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:b79fffb6-ae70-509a-a29f-acd846ae3848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:73208ab7-4460-536b-b6bb-69f5c60181ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:3e5b3b2e-d347-5348-b88b-cfd33ef9b4db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:c2b54178-af40-5f92-8a1b-c28ad8f01383", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.5-tuxcare.4 of dompurify, and is fixed in 3.0.5-tuxcare.5." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:92e36ca3-671c-50a8-8b77-e7403e7767aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.5-tuxcare.4 of dompurify. not_affected \u2014 DOMPurify v3.0.5 is NOT affected by CVE-2026-65903. The vulnerability is a regression introduced between v3.0.5 and v3.3.3. In v3.3.3, the condition `!(tagCheck(tagName)) && (!ALLOWED_TAGS || FORBID_TAGS)` allows tagCheck to short-circuit the FORBID_TAGS check. Version 3.0.5 uses a different architecture with an explicit guard `!FORBID_TAGS[tagName]` at line 1019 that prevents forbidden tags fr...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:af9c1998-5257-53b3-825d-b6471c0839c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.5-tuxcare.4 of dompurify. not_affected \u2014 DOMPurify 3.0.5 is not affected by CVE-2026-65912. The vulnerability requires the EXTRA_ELEMENT_HANDLING.attributeCheck feature, which allows ADD_ATTR to be specified as a predicate function that can bypass URI validation. Version 3.0.5 does not have this feature - it has no references to attributeCheck or EXTRA_ELEMENT_HANDLING, and only processes ADD_ATTR as an array via addToSet(). Without t...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:7f8a6777-864f-5df4-b4de-26b86972e062", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:b6baf0d9-ca0f-57b7-8c05-c4c7e6edcfa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:2130af80-a9fd-5d3f-97de-9bbd2c0ed238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:88707782-80e5-567d-bfdf-94b6923d22c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:bd028096-4ea7-5d66-b06c-7c8a1e5f4930", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:7e1b3b6b-5f10-5937-b3bf-c8ae358e21b4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:d2e6af56-570b-5c38-8879-0f3577328ebc", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.5-tuxcare.4 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:85f7ddcd-82da-544e-b882-416a2ce1cc33", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.5-tuxcare.4." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ], "bom-ref": "urn:uuid:d31b2328-c597-5d69-9bde-df604a9c903d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.0.5-tuxcare.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.4" } ] }