{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3073f41e-f0e3-527b-a116-d7a7fa1ebc15", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6-tuxcare.8", "type": "library", "bom-ref": "pkg:npm/dompurify@3.0.6-tuxcare.8", "version": "3.0.6-tuxcare.8", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.0.6", "type": "library", "version": "3.0.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:ffc2682a-14bc-5a8f-97e3-fc1496fe9c8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:f45de7e4-1075-5a57-a43c-497e55fdd725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:223b9d80-d6f3-512f-bd06-213d5062d60c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:2915f6a8-6168-5bf2-8bc9-835e608febb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:c983c28f-519c-5540-95b6-8cc62d12c154", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:e58dc780-3292-550a-bc39-c767c39e6043", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:4a3fcb5d-a785-5c3d-912c-a4bae29580b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:4dcd031e-3a90-5dbe-acd1-9fd8ffae323b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41240 does not affect version 3.0.6-tuxcare.8 of dompurify. not_affected \u2014 DOMPurify 3.0.6 is not affected by CVE-2026-41240. The vulnerability requires function-based ADD_TAGS/ADD_ATTR configuration support, which was introduced in version 3.3.0 (October 2025). Version 3.0.6 (September 2023) predates this feature by 2 years and only supports array-based ADD_TAGS/ADD_ATTR through the addToSet() utility. The vulnerable code pattern (EXTRA_ELEMENT_HANDLING.tagCheck shor...", "justification": "code_not_present" } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:6725d5e5-34ab-53ce-8a9f-ae123c98bad6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:95a94cb1-175a-58b4-8504-7ce87b9f329a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:70088f05-7a04-5b1e-a9d6-d366d563d49a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:b599dafb-26fa-54c3-89e5-6527a982d7a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:041d8f56-3324-5eac-a1db-b8088b851c8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:2ca6229f-71ea-5799-a6ae-773e31c7e83a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:a319af35-fb51-5a96-bc45-8684b06c7b2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:202c622f-570f-5f51-8ee0-fc1b76a671c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:89683d58-8014-5210-8536-679970bf1399", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.0.6-tuxcare.8 of dompurify. not_affected \u2014 Target version 3.0.6 is not affected by CVE-2026-65903. The vulnerability requires EXTRA_ELEMENT_HANDLING.tagCheck functionality (allowing ADD_TAGS as a function), which was introduced in version 3.3.1 (October 2025). Version 3.0.6 predates this feature and uses a simpler, safe tag validation pattern that always checks FORBID_TAGS before any custom element exceptions.", "justification": "code_not_present" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:e2a4d917-b344-5adf-978e-98e224304ca2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.0.6-tuxcare.8 of dompurify. not_affected \u2014 DOMPurify v3.0.6-tuxcare.1 is NOT AFFECTED by CVE-2026-65912. The vulnerability requires the function-based ADD_ATTR feature (allowing predicate functions via EXTRA_ELEMENT_HANDLING.attributeCheck) that bypasses URI validation. This feature was introduced in PR #1150 (commit fa239f04) AFTER v3.0.6 was released. Version 3.0.6 only supports array-based ADD_ATTR, which always flows through URI val...", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:8853b9c8-82c4-5bee-80e8-0ba398ec7a1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:ebdb79b1-a112-5116-acf7-52f0f6df132c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:e9917f40-554a-5749-8b31-e001c4872c4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:cfda49c1-2acf-53f3-86d7-e31d42fc2620", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:edecbd0a-c18a-5cac-a2b8-84637d96f246", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:ef9f9163-4cd7-5ac7-aeec-2df47918db02", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:9ca206cd-b5bf-5885-be6d-4d38ef595ebf", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.0.6-tuxcare.8 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:b9ca6cd8-04d5-55c4-86e6-f32b3e249123", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.0.6-tuxcare.8." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ], "bom-ref": "urn:uuid:53f87530-6777-509e-a318-99310b668617", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.0.6-tuxcare.8 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.0.6-tuxcare.8" } ] }