{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a8fd8dd3-484b-5461-96d0-19c8ab8e1e1a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.6-tuxcare.6", "version": "3.0.6-tuxcare.6", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6", "type": "library", "version": "3.0.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:6f4f1346-a9c1-523e-ad4c-5dda7ed7ec3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-45801 affects version 3.0.6-tuxcare.6 of dompurify, and is fixed in 3.0.6-tuxcare.8." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:c0e342c6-b86e-5c41-aa85-60afa5348d90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:a42c97ca-98ec-5774-a21b-b155c97e9de8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:257f1b0d-9b5b-5a43-9ccb-f70ee5f791d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:0c38c3c1-a4aa-580a-93a5-07c8f47afc3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:da2034c2-c6d9-5e3b-8121-21b67f0f9e6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:6ca7a745-2186-5cc6-93cf-7c643d206087", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41239 affects version 3.0.6-tuxcare.6 of dompurify, and is fixed in 3.0.6-tuxcare.8." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:dacb6721-aa15-53f9-8ead-a74b07257355", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.6-tuxcare.6 of dompurify. not_affected \u2014 DOMPurify 3.0.6 is not affected by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS/ADD_ATTR configuration support, which was introduced in version 3.3.0 (October 2025). Version 3.0.6 (September 2023) predates this feature by 2 years and only supports array-based ADD_TAGS/ADD_ATTR through the addToSet() utility. The vulnerable code pattern (EXTRA_ELEMENT_HANDLING.tagCheck shor...", "justification": "code_not_present" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:619f9ea5-a418-5cd1-b353-7279cfd9ce56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:28632c3c-87c6-54c9-9c5a-234de9c845c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:b1ea0145-5e3c-5349-b7bf-b9f189741554", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-49978 affects version 3.0.6-tuxcare.6 of dompurify, and is fixed in 3.0.6-tuxcare.7." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:8163ebac-3ec0-54d3-825f-80efa48bca7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:e95eafcf-69f4-5cc8-83a8-7bb8ae4b1cce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:428e4edd-af1a-5d2c-a102-9adf0191e50e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:1f5d7a24-bbdb-5e85-818d-a333bf986887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:b2ef8d61-9655-5f41-b2da-2787e0f067d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65902 affects version 3.0.6-tuxcare.6 of dompurify, and is fixed in 3.0.6-tuxcare.8." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:28b95666-9762-5229-80b3-7662489f5913", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.6-tuxcare.6 of dompurify. not_affected \u2014 Target version 3.0.6 is not affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck functionality (allowing ADD_TAGS as a function), which was introduced in version 3.3.1 (October 2025). Version 3.0.6 predates this feature and uses a simpler, safe tag validation pattern that always checks FORBID_TAGS before any custom element exceptions.", "justification": "code_not_present" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:97b201c6-c3ff-56fa-9a52-e1285febaff1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.6-tuxcare.6 of dompurify. not_affected \u2014 DOMPurify v3.0.6-tuxcare.1 is NOT AFFECTED by CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (allowing predicate functions via EXTRA_ELEMENT_HANDLING.attributeCheck) that bypasses URI validation. This feature was introduced in PR #1150 (commit fa239f04) AFTER v3.0.6 was released. Version 3.0.6 only supports array-based ADD_ATTR, which always flows through URI val...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:e5041546-d61c-5660-9f51-6f265a680cd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:66e6e67a-8503-5b01-981f-75ba7f50b964", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:bb58314d-8f8f-58fe-987b-79e476554f94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:df269b0e-45bf-574d-b416-89ebc6aa1109", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:352a3a0c-aaf1-5672-96c1-9693e6d43e75", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:14a7cfb0-0ba9-5da5-b043-befde8424c6a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:3d250069-94f4-5fc7-9d56-014b0bd74ca0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.6-tuxcare.6 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:f4d3c209-ac93-5245-859e-ffe3d82457b0", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.6-tuxcare.6." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ], "bom-ref": "urn:uuid:2390fba4-51a6-5a3c-8b4c-6dcd73dab22e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.0.6-tuxcare.6 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.6" } ] }