{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1708da73-f8c6-5eca-b39e-005e121788ea", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.5-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.5-tuxcare.5", "version": "3.0.5-tuxcare.5", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.5", "type": "library", "version": "3.0.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:6dccd0bc-a677-59fd-9c5f-e0ade3bc2209", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:bc1e4634-d151-5605-afdc-e8ce33fee2bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:44c49663-0923-573e-96a0-075f46b337be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:7580d9de-9bba-5836-b7c6-2eb79ea64b16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:38147557-4a2a-5812-866c-027ad6f446a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:13ea6c18-e229-5ff3-a58b-a5b2efca6b0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:a17f6e8d-8aa9-5106-89ca-5523171c4ccb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:165c323a-93e6-5c1b-9dca-55724cec79b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.5-tuxcare.5 of dompurify. not_affected \u2014 CVE-2026-41240 affects DOMPurify versions 3.3.0 and later that support function-based ADD_TAGS configuration. Target version 3.0.5 does not have this feature (introduced in 3.3.0, October 2025). The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck mechanism to bypass FORBID_TAGS checks via short-circuit evaluation - this mechanism is entirely absent from 3.0.5. Version 3.0.5 uses only arr...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:44c92e48-6125-5d5a-9bbc-0bc8fac9cadc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:49e85048-a118-521f-a2ea-76c5b7b413bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:d2093d6a-8def-5aa1-9a14-2ec0eb1a296e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:6f609a9b-4560-5b64-913a-abd2cec5d5b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:ca6c9eec-f9f0-50d1-b742-af1ff0ea3979", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:1b2974d5-6171-59f6-bccb-7793260409cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:6603f810-4f06-588f-9c0a-9730069c59d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:b34a0637-ae15-5bf9-a850-5c436be94986", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:33782fbc-9a4c-52a3-8049-ee8dfb1a8e8c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.5-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify v3.0.5 is NOT affected by CVE-2026-65903. The vulnerability is a regression introduced between v3.0.5 and v3.3.3. In v3.3.3, the condition `!(tagCheck(tagName)) && (!ALLOWED_TAGS || FORBID_TAGS)` allows tagCheck to short-circuit the FORBID_TAGS check. Version 3.0.5 uses a different architecture with an explicit guard `!FORBID_TAGS[tagName]` at line 1019 that prevents forbidden tags fr...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:6033404d-fbe3-5376-84de-e06fe2e60c69", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.5-tuxcare.5 of dompurify. not_affected \u2014 DOMPurify 3.0.5 is not affected by CVE-2026-65912. The vulnerability requires the EXTRA_ELEMENT_HANDLING.attributeCheck feature, which allows ADD_ATTR to be specified as a predicate function that can bypass URI validation. Version 3.0.5 does not have this feature - it has no references to attributeCheck or EXTRA_ELEMENT_HANDLING, and only processes ADD_ATTR as an array via addToSet(). Without t...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:8e7ff2d9-7c21-59fa-b9e8-5fb3a3f4c67f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:b8f1511e-2ff5-5e72-83bf-722c20c1e84b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:3d5451c7-151c-5492-aa73-2aaac60b96db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:1dfba8a0-4985-5e98-ad90-b6bb8975be66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:124a170a-79b7-58c5-ba86-e0a91ac49ffb", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:d64653d6-68b6-5936-8115-9670f3e58bb3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:7c83dacf-d0e6-52ee-b852-47387811c511", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.5-tuxcare.5 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:4e6c97e2-3202-5f22-ab37-100ba495405e", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.5-tuxcare.5." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ], "bom-ref": "urn:uuid:dfc589ed-2475-569b-acc9-92d3ce0a6d69", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.0.5-tuxcare.5 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.5-tuxcare.5" } ] }