{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dff8e43e-f9f5-5b37-b6fc-573654751051", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.1.6-tuxcare.11", "type": "library", "bom-ref": "pkg:npm/dompurify@3.1.6-tuxcare.11", "version": "3.1.6-tuxcare.11", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.1.6", "type": "library", "version": "3.1.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:090078c1-d495-5331-be83-501708ce3e49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:819595d2-5e08-589a-8f1e-3eec16ae99b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:e61b7a50-0081-5943-8803-aeb5b69df1ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:d9ac8aca-7a78-5768-8a91-e6bf3417303e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:5af1ea0a-1148-53ee-b282-b36d06f33f24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:0d201049-6fab-564e-878d-535a82ebcf2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:894f0600-0495-53cd-806e-63968fbc94fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:fb22586a-e649-52e3-96a5-04f958cca34c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:3edd089f-9099-5955-81e5-828ff64db855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:525c6bf3-c24b-56c4-ae52-1e2282cdd7c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:7ef3e014-bd14-522a-bdc0-871fc8e2f4b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:c2d5c95b-466f-5fcc-8898-694ce4ecc72a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:bd241c67-3aff-5ff2-834f-8864cbb08dfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:28420999-9d31-5827-a3bb-a5c6278440a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:7634c0d2-8183-56f8-b3ae-d68f78811bee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65901 does not affect version 3.1.6-tuxcare.11 of dompurify. not_affected \u2014 Version 3.1.6 is not affected by CVE-2026-65901. The target contains a defensive mechanism that uses a realm-safe cached prototype getter (getNodeName) to validate element types, which bypasses attacker-controlled own properties set via Object.defineProperty. The CVE explicitly targets version 3.4.6, which is newer than the target version 3.1.6.", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:77d50f38-5916-5fdf-b57b-f6d3cb17be94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:4caaf284-7d3a-5ccf-83b4-51446172133c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.1.6-tuxcare.11 of dompurify. not_affected \u2014 Target version 3.1.6-tuxcare.5 does not contain the vulnerable code pattern described in CVE-2026-65903. The CVE describes a short-circuit evaluation issue in v3.3.3 where ADD_TAGS as a function (via EXTRA_ELEMENT_HANDLING.tagCheck) can bypass FORBID_TAGS. In v3.1.6, the equivalent logic (CUSTOM_ELEMENT_HANDLING.tagNameCheck) includes an explicit guard at line 1538 that checks !FORBID_TAGS[tagN...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:1db9c162-92d9-55e2-9b6f-8c2e0b960976", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.1.6-tuxcare.11 of dompurify. not_affected \u2014 DOMPurify version 3.1.6 is not affected by CVE-2026-65912. The vulnerability requires predicate-based attribute allowlisting features (ADD_ATTR as a predicate function or EXTRA_ELEMENT_HANDLING.attributeCheck) that do not exist in this version. Version 3.1.6 predates these features entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:e105ca29-9800-52ca-ad8a-77c4cd0f11eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:ef52090c-9909-5349-b027-a6f58d0d447a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65914 does not affect version 3.1.6-tuxcare.11 of dompurify. not_affected \u2014 DOMPurify 3.1.6-tuxcare.5 is not affected by CVE-2026-65914. The target version contains a runtime defense mechanism (SAFE_FOR_XML, enabled by default) that removes attributes containing closing tags for special parsing-context elements (xmp, script, iframe, noembed, noframes, noscript). This defense prevents the mutation-XSS attack described in the CVE when DOMPurify is used with default confi...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:e69055c6-a866-552f-b269-60d323127acf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:93135968-f152-5f2c-ad20-5d349f93afd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:57717e88-9a24-5108-91b2-86431012f85e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:172b305e-0732-575a-8751-a73178202c90", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:88c2c2cb-da6a-530a-8c30-4fdb4c0ec1b4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:40e95607-34cb-5d86-9981-c28681194b21", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:36d40a16-edf0-5935-a633-6ea0c80f592c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:965bec24-7c7e-5258-bf55-bcedbf0afc0e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:57fb6320-d8dd-5303-a38c-cc0e3ee57296", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:4d509fe9-c6cb-5e77-99bd-8e4cb1e44408", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:53197dfb-712a-5a45-8bf8-bf048c66d4c8", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:b004883a-c223-5aa3-81a0-89428f11fbda", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:1b7f2d7e-928d-56f8-a37c-3501b2974a2f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:16d299e6-021c-58bc-b452-2eed473502e3", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.1.6-tuxcare.11." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:e2d71b47-76cd-5ef5-93dd-e1e985d74c9a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:643260f6-062f-5b4b-8d6c-70c2aae8f572", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.1.6-tuxcare.11 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ], "bom-ref": "urn:uuid:e9dccfe8-2091-5f02-991f-f58e6161865d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.1.6-tuxcare.11 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.1.6-tuxcare.11" } ] }