{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bec54478-b7e9-5566-adec-3ff2e4a96e86", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.3-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/dompurify@3.2.3-tuxcare.7", "version": "3.2.3-tuxcare.7", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@3.2.3", "type": "library", "version": "3.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:cbe35bc6-a877-5dbb-a0a5-4de610fa2f7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-15599 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:20196ab3-beb7-5e0f-b290-36986669b539", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a5e7265a-cff4-504e-9526-16957f58a73d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-0540 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:2d791092-c428-5b9a-9d87-30731df589c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:8295e2a3-7eff-52eb-8270-77c04dca7adc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-116803 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:6636d0e5-f3be-519e-8dc3-4c1c41e81bed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41238 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:d7d15fdb-69e0-5c79-af21-beee0ffd4ad8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:a19e4139-4c19-55cc-b129-d5b1ba569496", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:3542901e-ad18-5453-ba45-90b24b108eed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:8a68b9a0-7aef-5f42-8b85-22e4a8353f8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:782e2efc-d598-5fc4-871e-eb152f141e25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:b39e95dc-3ffd-52e3-b961-694ede7efe72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:edb5782d-3b5d-5a9e-8ba7-f25afd2e51b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:8846ef81-7834-51ce-8f5f-b6f4997290d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65900 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:5b737452-5d31-5259-9e40-99c05d70af74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:ca783bea-6e2c-5393-9ff6-59c0dbbc9d54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:773bdc65-8e4c-5cab-b0e0-30c9145c7c2f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65903 does not affect version 3.2.3-tuxcare.7 of dompurify. not_affected \u2014 CVE-2026-65903 does not affect DOMPurify version 3.2.3. The vulnerability described in the CVE was introduced in version 3.3.3 through a new API (EXTRA_ELEMENT_HANDLING.tagCheck) that does not exist in version 3.2.3. The target version uses CUSTOM_ELEMENT_HANDLING.tagNameCheck with correct logic that explicitly checks FORBID_TAGS before evaluating custom element predicates, preventing the short...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:4be57f50-86f3-5705-85ab-3f35ef49728a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-65912 does not affect version 3.2.3-tuxcare.7 of dompurify. not_affected \u2014 DOMPurify 3.2.3-tuxcare.2 is not affected by CVE-2026-65912. The vulnerability requires EXTRA_ELEMENT_HANDLING.attributeCheck predicate functionality that was introduced in upstream versions after 3.2.3. In this version, ADD_ATTR is constrained to string arrays only, and no predicate-based bypass mechanism exists that would allow dangerous protocols to skip URI validation in _isValidAttribute.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:ff9a8a86-65e5-5e3c-a1b4-975d974fb928", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:f578908a-23c0-5197-aa51-7bed4c49d104", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:8d4e7da0-4a38-54f5-9689-06b19a091c04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-66010 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:47c7af47-536e-520f-a664-8e618dc4c2ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-75838 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-39q2-94rc-95cp", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:1015c176-56ca-5761-8027-0b25bbcf1c00", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-39q2-94rc-95cp is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:c985ada4-f9f9-5441-b694-0faaaf019ca4", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:917e1ead-3b22-5680-84e9-a772f07adaa2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-76mc-f452-cxcm", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:6b6734d0-584d-5201-8782-e2784ff0a31e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-76mc-f452-cxcm is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-c2j3-45gr-mqc4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:6f37882a-9055-5155-b8b7-371914a229ab", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c2j3-45gr-mqc4 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:cb3ca2a6-82ad-5bbe-9c24-f57e4287723b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-cj63-jhhr-wcxv", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:76a2b132-2020-5819-9c9b-d34973e0be07", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cj63-jhhr-wcxv is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-cjmm-f4jc-qw8r", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:8aadb02e-77c1-5d81-8617-52d922eb2fa9", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cjmm-f4jc-qw8r is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-cmwh-pvxp-8882", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:23156d6e-6988-5507-99e4-4aeb4266bdc8", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-cmwh-pvxp-8882 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-gvmj-g25r-r7wr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:f73b6ab8-c1f8-5224-b2a4-3644b32ece5c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-gvmj-g25r-r7wr is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-h8r8-wccr-v5f2", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:dc576ba2-0a57-5361-84e6-e3aed537181a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-h8r8-wccr-v5f2 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:fdfef2a5-8c00-5224-9df4-2b0313786da7", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 3.2.3-tuxcare.7." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:5c2eb2c1-5077-5d3c-80e5-b2432a2420ed", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-vxr8-fq34-vvx9", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:90981640-5891-5e5f-8347-3ac80f451bc0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vxr8-fq34-vvx9 is fixed in version 3.2.3-tuxcare.7 of dompurify." } }, { "id": "GHSA-x4vx-rjvf-j5p4", "affects": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ], "bom-ref": "urn:uuid:7f887b53-77d8-571f-aac8-52746f9970a2", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x4vx-rjvf-j5p4 is fixed in version 3.2.3-tuxcare.7 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@3.2.3-tuxcare.7" } ] }